Use the Cribl Copilot Chatbot
The Cribl Copilot chatbot is an AI assistant designed to streamline your interaction with Cribl products and integrations. You can use the chatbot across Cribl Stream, Cribl Search, Cribl Edge, and Cribl Lake to get prompt responses to common issues and configuration questions. The Cribl Copilot chatbot is also available here in Cribl Docs and as an app in the Cribl community Slack workspace.
Specifically, the chatbot can help you:
- Answer technical questions: Detailed responses to questions about Cribl, Docker, Kubernetes, and regex
- Inspect your deployment: Answers to questions about your own Worker Groups, Sources, Destinations, Routes, Pipelines, system health, and more, drawn from your live configuration
- Troubleshoot problems: Step-by-step solutions for common issues and errors, combining the documentation with the current state of your deployment
- Find documentation: Relevant content from Cribl documentation
- Use integrations: Assistance with setup and configuration of integrations with Docker and Kubernetes
- Write regular expressions (regex): Help with regex construction and debugging
- Generate basic KQL: In the drop-down next to the Cribl Copilot text box, select Generate KQL. For more advanced KQL generation in Cribl Search, see Writing KQL queries with Cribl Copilot.
Get Started
Cribl AI is a native part of the product and available by default, so the Cribl Copilot chatbot is available without any setup. For details, see Cribl AI Availability.
To start using the chatbot, select the Cribl Copilot icon at the bottom right of any product page. If you have not yet accepted the Cribl AI terms of service, the widget is still visible and you can complete consent through the in-widget modal. After accepting the terms, activate the feature and start typing a question or request.
Where the Chatbot Appears
In Cribl.Cloud, the chatbot widget appears inside product Workspaces only. It does not appear on Organization-management pages such as manage.cribl.cloud, or on App Platform routes. In on-prem deployments, the widget appears on Cribl Stream, Cribl Search, Cribl Edge, and Cribl Lake product pages.
How to Use Prompts Successfully
Follow these guidelines to get clear answers, thorough instructions, and helpful tips tailored to your specific context.
| Best Practice | Example |
|---|---|
| Use clear and concise language. | Show me how to configure a Cribl Pipeline. |
| Provide context or background information. | How do I integrate Cribl with Docker on a Kubernetes cluster? |
| Describe issues thoroughly. | I’m getting the following regex error in Cribl. How can I resolve it? |
| Provide output examples. | Create a detailed summary of how Cribl Search works. The output should be formatted like this: Overview … Integrations … Example Queries … |
| Ask for specific documentation. | Include the Cribl documentation on data routing. You can also reference specific sections or topics from Cribl, Docker, Kubernetes, or regex documentation for more detailed answers. |
| Refine your queries. | If the response isn’t exactly what you were looking for, refine your question or ask follow-up questions to improve the result. |
| Provide feedback. | Select the thumbs-up or thumbs-down button to share feedback on responses to help improve the accuracy and relevance of Cribl Copilot. |
Ask About Your Cribl Deployment
In addition to product knowledge, the chatbot can answer questions about your Cribl deployment. When you ask about the state of your environment, the chatbot uses read-only tools to inspect your configuration and live status, then summarizes the results. This saves you from manually navigating the UI or running multiple queries.
You can ask the chatbot about:
- Worker Nodes and Groups: Worker Groups, Distributed deployment summaries, system information, and enabled features.
- Sources and Destinations: Configured Sources and Destinations, live I/O status, byte counts, event counts, and persistent queue status.
- Routing and processing: Routes, Pipelines, Packs, Collectors, Event Breakers, Global Variables, and Lookups in Cribl Stream.
- Search resources: Datasets, saved queries, macros, and search engines in Cribl Search.
- Edge deployments: Edge Fleets, Edge Node processes, containers, and host information in Cribl Edge.
- Lake resources: Lake Datasets, Lakehouses, Lake Sources, and Lake storage locations in Cribl Lake.
- System status: Overall health, system messages and notifications, running processes, logger configuration, alert conditions, monitor configuration, and Notification Policies.
The chatbot provides answers based only on the inspection tools available in your deployment. For example, it surfaces Cribl Search resources only when Cribl Search is part of your deployment.
Example Prompts
| Goal | Example Prompt |
|---|---|
| Inventory | Show me my Worker Groups. |
| Inventory | List my configured sources and destinations in the default group. |
| Live status | What’s the live throughput for my Splunk destination? |
| Live status | Are any of my sources reporting errors right now? |
| Queue health | What’s the status of my persistent queues? |
| System health | Give me a health check of my deployment. |
| Troubleshooting | Why are events not reaching my S3 destination? |
| Capabilities | Which Cribl AI features are available in this Workspace? |
How the Chatbot Protects Your Configuration
When the chatbot reads your configuration, the information that its read-only inspection tools return might be sent to your configured AI provider to generate a response. Cribl applies the following safeguards to limit what those tools expose:
- Global Variable value exclusion: The chatbot’s Global Variable inspection tool omits variable values, which can contain secrets, and returns only variable names and metadata.
- Summary projections and field omission: Some inspection tools return metadata-level summaries, such as IDs, types, and short descriptions, and omit selected fields rather than returning complete configuration objects.
- Configurable Source and Destination masking: Administrators can configure named sensitive fields to mask in Source and Destination API responses. Apply this configuration to each relevant Worker Group, and review it when configurations or integrations change, because masking covers only the field names you list.
- Capability gating: Inspection tools that don’t apply to your deployment are not available to the chatbot. For example, Distributed-only tools are unavailable in a Single-instance deployment.
How the Chatbot Works
The Cribl Copilot chatbot combines a foundational large language model (LLM) with two grounding systems:
- Documentation retrieval: A live, domain-restricted search over Cribl Docs, routed through the Cribl AI service, that draws on Cribl product documentation to answer questions about Cribl concepts and features. Because the search runs against the live documentation site rather than a pre-built index, results reflect current content. This retrieval requires outbound connectivity from the Leader to
ai.cribl.cloudon port443. For details, see Cribl Copilot Port. Documentation answers include citations to the source pages on Cribl Docs. - Deployment inspection: A set of read-only tools that the chatbot can call to inspect your live Cribl configuration, as described in Ask About Your Cribl Deployment.
For troubleshooting questions, the chatbot can use both grounding systems together. It retrieves relevant documentation for context, then inspects your deployment for specifics, and synthesizes the two sources into a single answer. Responses clearly separate guidance based on documentation from observations about your specific deployment.
What the Chatbot Doesn’t Do
The chatbot has no direct access to the data flowing through Cribl, so it can’t answer questions like, “Where are my VPC logs?” or summarize event content. Inspection tools see your configuration and operational status only, and not the events themselves.
This chatbot, like any AI, is still learning. It may not answer all questions perfectly, so review responses carefully. To help Cribl Copilot learn, select the thumbs-up or thumbs-down button on any response to provide feedback.