C.Schema - Schema Methods ​

C.Schema ​

C.Schema: (id: string, options?: { kind?: 'json' | 'parquet' }) => SchemaValidator

Returns a validator for a JSON or Parquet schema in the Knowledge library. By default, C.Schema returns a JSON schema validator. To validate against a Parquet schema, set kind to parquet.

C.Schema.validate() ​

C.SchemaValidator.validate(data: unknown): boolean

Validates the given data against the schema. For Parquet schemas, the data can be an object or a JSON string.

Returns true when the data conforms to the schema. Otherwise, returns false.

Examples ​

To validate whether myField conforms to the JSON schema schema1, use:

C.Schema('schema1').validate(myField)

To validate whether an event conforms to the Parquet schema cloudtrail, use:

C.Schema('cloudtrail', { kind: 'parquet' }).validate(__e)

Parquet validation returns false for non-conforming data, malformed JSON strings, and unknown schema IDs. It does not throw an error.

C.Schema.explain() ​

C.SchemaValidator.explain(data: unknown): SchemaExplainResult

Validates the data and returns an object containing validation details. For valid data, it returns { valid: true }. For invalid data, it returns { valid: false } and can also include the field and message properties.

Use validate() in filters that process every event. Use explain() when you need details to troubleshoot a validation failure, such as in Data Preview while you refine a schema. Schema validation is computationally expensive compared with a typical filter.

For example:

C.Schema('cloudtrail', { kind: 'parquet' }).explain(__e)

For more information, see JSON Schemas and Parquet Schemas.

C.Secret - Secrets-Management Methods ​

C.Secret() ​

C.Secret: (id: string, type?: string, folderId?: string): ISecret
C.Secret(id: string, type: 'keypair', folderId?: string) => IPairSecret
C.Secret(id: string, type: 'text', folderId?: string) => ITextSecret
C.Secret(id: string, type: 'credentials', folderId?: string) => ICredentialsSecret

Returns a secret matching the specified ID.

Examples ​

To return a text secret with ID victorias (or with undefined, if no such secret exists), use:

C.Secret('victorias', 'text')

You can also get attributes of secrets with the following expressions:

C.Secret('api_key', 'keypair').secretKey
C.Secret('secret_hash', 'text').value
C.Secret('user_pass', 'credentials').password

Common returned attributes for ISecret objects:

• secretType - one of keypair, text, or credentials.
• description (optional) - the secret description.
• tags (optional) - a comma separated list of tags.
• folderId (optional) - for a global secret, the ID of the secret folder that contains it.

Additional returned attributes for IPairSecret objects:

• apiKey - the API key value
• secretKey - the Secret key value

Additional returned attributes for ITextSecret objects:

• value - the text value

Additional returned attributes for ICredentialsSecret objects:

• username - the username value
• password - the password value

Global Secrets ​

To reference a global secret, pass the ID of the secret folder that contains it as the third argument:

C.Secret('api_key', 'keypair', 'finance-prod').secretKey

The folderId parameter selects where Cribl looks for the secret. Omit it and C.Secret() searches only the local secrets manager, so a global secret resolves to undefined instead of raising an error. Supply folderId whenever the secret lives in a secret folder.

For global secrets, the returned id is the composite reference folderId/secretId, such as finance-prod/api_key.

Some Sources and Destinations expose global secrets directly through a Secret authentication method, which resolves the secret folder for you. Use C.Secret() with folderId only in JavaScript expression fields. See Use Global Secrets.

See Securing Cribl Stream > Secrets for more details.

C.env - Environment ​

C.env ​

C.env: Record<string, string | undefined>

Returns an object containing Cribl Edge’s environment variables.

In version 4.20.0 or later, Cribl filters C.env through an allowlist for security. Only the following variable names are accessible:

• Variables starting with CRIBL_, except for the excluded names CRIBL_CLOUD_SECRET_ID, CRIBL_DIST_AUTH_TOKENS, CRIBL_DIST_LEADER_URL, and CRIBL_DIST_MASTER_URL.
• A small built-in set of non-CRIBL_ variables: ACCOUNTID, AWS_DEFAULT_REGION, AWS_REGION, DEPLOYMENT_NAME, NODE_ENV, and TENANT_ID.

Cribl omits any other environment variable from C.env, so it evaluates to undefined even when it is present in the operating system environment of the Worker or Node. To make a custom non-sensitive environment variable accessible in expressions, prefix its name with CRIBL_ (for example, CRIBL_SITE_CODE), then reference it as C.env.CRIBL_SITE_CODE. See Environment Variables for details.

Do not expose credentials or other secrets through C.env. Store sensitive values as secrets and retrieve them with C.Secret().

Examples ​

To return the parent of Cribl’s bin directory (generally /opt/cribl), use:

C.env.CRIBL_HOME

To return the hostname of the machine where Cribl Edge is running, use:

C.os.hostname()

C.os - System Methods ​

C.os.hostname() ​

Returns hostname of the system running this Cribl Edge instance.

C.vars - Global Variables ​

See Global Variables Library for more details.

Outside Packs, C.vars returns Fleet variables. Inside Packs, C.vars returns Pack-local variables only. To reference Fleet variables inside a Pack, use C.systemVars in JavaScript-enabled fields, or bind them to configuration fields that display the Variable icon .

C.systemVars - Fleet Variables ​

C.systemVars exposes evaluated Fleet variables inside Pack contexts. Use it in JavaScript-enabled fields when you need the deploying Fleet’s value at runtime. Examples include Pipeline Function expressions, custom fields on Sources and Destinations, Collector settings, and Event Breaker conditions.

Reference variables using dot notation (C.systemVars.region) or bracket notation (C.systemVars['my_var']) when the name contains underscores or other special characters. For expression-type Fleet variables, use the same syntax as C.vars: call them with arguments, such as C.systemVars.myExpr(arg1).

C.systemVars is read-only. You cannot assign to it or modify Fleet variables from Pack expressions. It is not available outside Pack contexts.

Referencing C.systemVars can affect Pack portability. If you export or copy a Pack to another Fleet that does not define a referenced Fleet variable, expressions that use C.systemVars may resolve to undefined at runtime.

C.version - Cribl Edge Versions ​

C.version ​

Returns the Cribl Edge version currently running.

C.confVersion ​

Returns the commit hash of the Edge Node’s current config version. (Evaluates only against live data sent through Edge Nodes. Values will be undefined in the Leader’s Preview pane.)

C.Misc - Miscellaneous Utility Methods ​

C.Misc.zip() ​

C.Misc.zip(keys: string[], values: any[], dest?: any): any

Sets the given keys to the corresponding values on the given dest object. If dest is not provided, a new object will be constructed.

Returns object on which the fields were set.

Examples ​

Let’s take the following expression:

people = C.Misc.zip(titles, names)

If sample data contains: titles=['ceo', 'svp', 'vp'], names=['foo', 'bar', 'baz'], this expression create an object called people, with key names from elements in titles, and with corresponding values from elements in names.

Result: "people": {"ceo": "foo", "svp": "bar", "vp": "baz"}

C.Misc.uuidv4() ​

C.Misc.uuidv4(): string

Returns a version 4 (random) UUID in accordance with RFC-4122.

Examples ​

To create a UUIDv4, use:

C.Misc.uuidv4()

Result: a conforming UUIDv4, such as 58d8be36-4db0-4b1c-ac80-28bb03c45e0d. It is highly improbable that two version 4 UUIDs will ever have the same value.

C.Misc.uuidv5() ​

C.Misc.uuidv5(name: string, namespace: string): string

Returns a version 5 (namespaced) UUID in accordance with RFC-4122 for the given name and namespace. If namespace is not a valid UUID, this function will fail.

Examples ​

To create a UUIDv5 with the predefined DNS namespace, use:

C.Misc.uuidv5('example', 'DNS')

Result: a UUID that is highly likely to be the same for the same name and namespace. In this case, the result would be 7cb48787-6d91-5b9f-bc60-f30298ea5736.

C.Misc.uuidv7() ​

C.Misc.uuidv7(): string

Returns a version 7 (time-sortable) UUID in accordance with RFC 9562. UUIDv7 encodes a millisecond-precision Unix time in the first 48 bits, so values generated later are lexicographically greater than values generated earlier. This makes UUIDv7 useful when you want identifiers that sort by creation time, such as for debugging.

Examples ​

To create a UUIDv7, use:

C.Misc.uuidv7()

Result: a conforming UUIDv7. Each call produces a unique value. Later calls produce values that sort after earlier ones when compared as strings.

C.Misc.validateUUID() ​

C.Misc.validateUUID(maybeUUID: string): boolean

Returns true if maybeUUID is a valid UUID of any version, and false otherwise.

Examples ​

C.Misc.validateUUID(C.Misc.uuidv4())

Result: returns true

C.Misc.validateUUID('clearly not a UUID')

Result: returns false

C.Misc.getUUIDVersion() ​

C.Misc.getUUIDVersion(uuid: string): number

Returns a number of the UUID version given by uuid if it is a valid UUID, otherwise undefined.

Examples ​

C.Misc.getUUIDVersion(C.Misc.uuidv4())

Result: 4

C.Misc.getUUIDVersion(C.Misc.uuidv5('example', 'X500'))

Result: 5

C.Misc.getUUIDVersion(C.Misc.uuidv7())

Result: 7

C.WorkerGroupId ​

C.WorkerGroupId: string

Returns the name of the current Fleet. Use this expression to enrich logs or metrics with the Fleet identity, enabling filtering and grouping in dashboards and analytics tools. This method always returns a string, even in single-node deployments.

Prefer C.WorkerGroupId over C.env.CRIBL_GROUP_ID where possible. The environment variable may be unset or stale, whereas C.WorkerGroupId always reflects the current Fleet assignment from your configuration.

Example ​

To add the current Fleet name to an event field:

__e.worker_group = C.WorkerGroupId