Skip to main content

hOTEL. mOTEL. Get Your Metrics in!

Cloudy with a chance of Cribl

This feature page was published on a previous version of the What's New with Cribl sandbox; therefore, the instructions are no longer valid.

TL;DR

Cribl Edge and Stream now ship with a Function that converts metrics to OTLP format. No need to do manually, just drop in the Function and enjoy your daydata!

Here at Cribl, our mission is To help our customers unlock the value of all their IT and Security data. Ultimately, the Cribl software suite makes it possible to couple ingesting any data source, and even auto-discovering new data sources, and sending data to any destination with the ability use open formats (raw data).

All that is basically to say, we believe in helping make our customers' lives easier. One way we do that in v4.5 is the OTLP Metrics Function. The OTLP Metrics Function transforms dimensional metrics events into the OTLP (OpenTelemetry Protocol) format. This Function can be used to send metric events (events that contain the internal field __criblMetrics) to any OpenTelemetry Metrics-capable destinations.

As always, before we begin, we must insist you read the Cribl docs regarding this neat new feature. Done? Let's check it out!

Let's Get Ready for Action
  1. On the left side of the Cribl UI, click Manage in the Stream section
  2. Click on the default Worker Group in the top left
  3. Now that we're managing Stream, click on the Processing submenu, then click Pipelines
  4. Click into the Pipeline named prometheus_metrics

*Record scratch* Prometheus? What happened to OTLP?

Worry not, we're here to showcase a big use of the OTLP Metrics Function: Prometheus to OTLP. Our customers have brought up that they have Prometheus metrics but they want them in an OTeL format. Well, let's do just that! By making out metrics Prometheus format and then OTLP. lol

Grab a Sample
  1. On the right-hand side of the Cribl UI, click Capture Data
  2. In the Filter Expression field at the top of the modal, put 
    __inputId=='cribl:CriblMetrics'
  3. Click Capture at the top right
  4. Click Start
  5. Once the capture finishes, click the Save as Sample File at bottom right
  6. Click Save

This sample we've just captured should now be displayed on the right side of our Cribl UI in the Simple Preview pane. You should also see that the events in our capture have been slightly modified (if not, click OUT in the top left of the Simple Preview pane). If we read the comment at the top of the Pipeline we see:

This pipeline adds the job and instance dimensions some Grafana dashboards expect in metrics from Prometheus.

This means we can generally refer to these metrics now as Prometheus metrics. Right? You gotta believe! Anyway, let's get to the reason we're here: OTLP Metrics Function.

Offbeat Tango Luchador Party!
  1. At the top of the Pipeline, click Add Function
  2. Type in OTLP and click the OTLP Metrics Function
  3. Click Save at the bottom of the Pipeline
  4. Observe the new event format in the Sample Preview pane at right

Wowee! With what felt like very minimal effort, our metrics are now in OTLP format. How simple was that?! Drop a single Function in your Pipeline and you're ready to go. Feel free to stay here and play around a bit. I know it's pretty cool.

When you're ready, let's move on to our new Cribl Edge Destination Disk Spool.