Hey everyone. Been lurking for a bit, finally setting up our own log pipeline. We're a team of about 30 devs & SREs, and we were drowning in SaaS log bills (you know the usual suspects). We looked at Cribl as a way to get control before the data hits the expensive destinations.
Short version: It's powerful, but it's a tool for operators, not something you just hand off. We run it in Docker on our own infra.
The good:
* Filtering out the noise (debug logs, health checks) before Splunk was a game changer. Our ingest volume dropped by like 40% pretty much day one.
* The Parser feature saved our butts integrating a niche internal app. Writing a quick regex pipeline was way easier than modifying the app.
* Routing some data to S3 for cheap archival worked without a hitch.
The gotchas:
* The learning curve is real. "Stream" vs "Pipeline" vs "Pack" logic took some head-scratching.
* It becomes a critical piece of infra. If Cribl goes down, logs stop flowing. Needed to build in redundancy, which added complexity.
* While it saves money, you're trading one cost for another (self-hosted compute/storage, our time to manage it).
For a team with container experience and a real pain point around log costs, it's worth the investment. If you just want a simple "set and forget" solution, this might be overkill. Curious if others have similar experiences or found simpler open-source alternatives for pre-processing?
Self-host or die trying.