添加链接
注册
登录
link管理
链接快照平台
输入网页链接,自动生成快照
标签化管理网页链接
相关文章推荐
温暖的啄木鸟
·
诗意千重话郴州-新华每日电讯
·
6 天前
·
读研的水煮鱼
·
trust(html) - Mithril ...
·
1 周前
·
失望的鸵鸟
·
今天终于拿到了极米h5投影仪,迫不及待地使用 ...
·
1 月前
·
谦虚好学的消防车
·
Excel中关于“&”的用法你知道多少?
·
2 月前
·
风度翩翩的镜子
·
【【专家观点】发展新质生产力要突出因地制宜】 ...
·
4 月前
·
link管理
›
Common Errors and Warnings | Cribl Docs
https://docs.cribl.io/stream/3.1.3/common-errors
风度翩翩的创口贴
1 年前
</noscript><div><a href="#" class="skipToContent_OuoZ">Skip to main content</a></div><nav class="navbar cribl-navbar"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewbox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"/></svg></button><a class="navbar__brand" href="/"><img class="navbar__logo" src="/img/page/cribl.logo.svg" alt="Cribl Docs"/></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/stream">Stream</a><a class="navbar__item navbar__link" href="/edge">Edge</a><a class="navbar__item navbar__link" href="/search">Search</a></div><div class="navbar__items navbar__items--right"><a class="navbar__item navbar__link" href="/api">API</a><a href="https://community.cribl.io/" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>Q&A<svg width="13.5" height="13.5" aria-hidden="true" viewbox="0 0 24 24" class="iconExternalLink_wgqa"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"/></svg></span></a><a href="https://cribl.io/community" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link"><span>Community<svg width="13.5" height="13.5" aria-hidden="true" viewbox="0 0 24 24" class="iconExternalLink_wgqa"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"/></svg></span></a><div class="noTogglePadding_mSJp"> </div></div></div></nav><nav class="navbar app-navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"/><div class="navbar__items navbar__items--right"><div class="toggle_iYfV theme-toggle toggle_iQ2x toggleDisabled_xj38"><div class="toggleTrack_t-f2" role="button" tabindex="-1"><div class="toggleTrackCheck_mk7D"><span class="toggleIcon_pHJ9">🌜</span></div><div class="toggleTrackX_dm8H"><span class="toggleIcon_pHJ9">🌞</span></div><div class="toggleTrackThumb_W6To"/></div><input type="checkbox" class="toggleScreenReader_h9qa" aria-label="Switch between dark and light mode"/></div></div></div></nav><div class="main-wrapper docs-wrapper docs-doc-page"><div class="docPage_lDyR"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_i9tI" type="button"/><aside class="docSidebarContainer_0YBq"><div class="sidebar_LIo8"><nav class="menu thin-scrollbar menu_oAhv"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--category hasHref_WoYW" href="/stream/"><span class="menu__link--prefix category"> </span><span class="menu__link--label category">Introduction</span></a></div><ul class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Welcome</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/about"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">About Cribl LogStream</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/basic-concepts"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Basic Concepts</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/getting-started-guide"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Getting Started Guide</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/distributed-guide"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Distributed Quick Start</span></a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--category hasHref_WoYW" href="/stream/3.1.3/deploy-types"><span class="menu__link--prefix category"> </span><span class="menu__link--label category">Deployment</span></a></div><ul class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/deploy-types"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Deployment Types</span></a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/scaling"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Sizing and Scaling</span></a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/configuration-files"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Config Files</span></a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/licensing"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Licensing</span></a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/access-management"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Access Management</span></a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/securing-and-monitoring"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Securing</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/version-control"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Version Control</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/persistent-queues"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Persistent Queues</span></a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/monitoring"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Monitoring</span></a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/notifications"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Notifications</span></a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/upgrading"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Upgrading</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/uninstalling"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Uninstalling</span></a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--category hasHref_WoYW" href="/stream/3.1.3/event-model"><span class="menu__link--prefix category"> </span><span class="menu__link--label category">Working With Data</span></a></div><ul class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/event-model"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Event Model</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/event-processing-order"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Event Processing Order</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/routes"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Routes</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/pipelines"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Pipelines</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/data-onboarding"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Data Onboarding</span></a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/functions"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Functions</span></a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/collectors"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Collector Sources</span></a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/sources"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Sources</span></a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/destinations"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Destinations</span></a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/packs"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Packs</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/data-preview"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Data Preview</span></a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/securing-data"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Securing Data</span></a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/scripts"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Scripts</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/datagens"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Using Datagens</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/cli-reference"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">CLI Reference</span></a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--category hasHref_WoYW" href="/stream/3.1.3/introduction-reference"><span class="menu__link--prefix category"> </span><span class="menu__link--label category">Expression Reference</span></a></div><ul class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/introduction-reference"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Introduction to Expression Syntax</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/cribl-reference"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Cribl Expressions</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/string-reference"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">String</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/date-reference"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Date</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/math-reference"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Math</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/number-reference"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Number</span></a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--category hasHref_WoYW" href="/stream/3.1.3/regex-library"><span class="menu__link--prefix category"> </span><span class="menu__link--label category">Knowledge</span></a></div><ul class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/regex-library"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Regex Library</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/grok-patterns-library"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Grok Patterns Library</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/event-breakers"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Event Breakers</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/lookups-library"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Lookups Library</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/parsers-library"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Parsers Library</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/schema-library"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Schema Library</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/global-variables-library"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Global Variables Library</span></a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--category hasHref_WoYW" href="/stream/3.1.3/tips"><span class="menu__link--prefix category"> </span><span class="menu__link--label category">Techniques & Tips</span></a></div><ul class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/tips"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Tips and Tricks</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-ingest-time-fields"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Ingest-time Fields</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-ingest-time-lookups"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Ingest-time Lookups</span></a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/usecase-sampling"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Sampling</span></a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-masking-and-obfuscation"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Masking and Obfuscation</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/large-lookups"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Managing Large Lookups</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-lookups-filters"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Lookups as Filters for Masks</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-lookups-regex"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Lookups and Regex Magic</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-regex-filtering"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Regex Filtering</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-encrypting-data"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Encrypting Sensitive Data</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-syslog"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Syslog Data Reduction</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-splunk-elasticsearch"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Splunk to Elasticsearch</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-win-xml"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Reducing Windows XML Events</span></a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/usecase-rest"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Using REST/API Collectors</span></a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/proxy-config"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">System Proxy Configuration</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-aws-x-account"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">AWS Cross-Account Data Collection</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-azure-ad"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">OpenID + Azure AD Configuration</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-sso-okta"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">SSO/Okta Configuration</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/usecase-code-function"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Code Function Examples</span></a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--parent hasHref_WoYW" tabindex="0" href="/stream/3.1.3/usecase-setup-guides"><span class="menu__link--prefix master"> </span><span class="menu__link--label master">Setup Guides</span></a></div></li></ul></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/stream/3.1.3/videos"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Videos</span></a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--category menu__link--active hasHref_WoYW" href="/stream/3.1.3/diagnosing"><span class="menu__link--prefix category"> </span><span class="menu__link--label category">Troubleshooting</span></a></div><ul class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/diagnosing"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Diagnosing Issues</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/support-contact"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Working with Cribl Support</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/known-issues"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Known Issues</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active active" aria-current="page" tabindex="0" href="/stream/3.1.3/common-errors"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Common Errors and Warnings</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/git-push-errors"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Git Push Errors</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/git-certificate-errors"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Git Remote Repos & Trusted CAs</span></a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--category hasHref_WoYW" href="/stream/3.1.3/third-party-current-list"><span class="menu__link--prefix category"> </span><span class="menu__link--label category">Third-Party Software</span></a></div><ul class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/stream/3.1.3/third-party-current-list"><span class="menu__link--prefix link"> </span><span class="menu__link--label link">Credits</span></a></li></ul></li></ul></nav></div></aside><main class="docMainContainer_r8cw"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_zHA2"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->Stream<!-- --> <b>3.1.3</b>, which is no longer actively maintained.</div><div class="margin-top--md">See the <b><a href="/stream/common-errors">latest version</a></b> (<!-- -->4.1<!-- -->).</div></div><div class="docItemContainer_oiyr"><article><span class="theme-doc-version-badge badge badge--secondary">Version: <!-- -->3.1.3</span><div class="tocCollapsible_aw-L theme-doc-toc-mobile tocMobile_Tx6Y"><button type="button" class="clean-btn tocCollapsibleButton_zr6a">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1 class="anchor anchorWithStickyNavbar_yP2J">Common Errors and Warnings<a aria-hidden="true" class="hash-link" href="#" title="Direct link to heading"></a></h1></header><p>This page lists common error and warning messages that you might find in LogStream's internal logs and/or UI. It includes recommendations for resolving the errors/warnings. Messages are grouped by component (Sources, Destinations, etc.). Note that:</p><ul><li><p>We've excerpted only the salient part of the error message from each event. We haven't listed full events.</p></li><li><p>Examples don't preserve case sensitivity from the original events. </p></li><li><p>NodeJS serves as the LogStream backend and has a large collection of well documented errors of its own. Some of system-level are listed below with the appropriate action to take. The remainder are documented at <a href="https://nodejs.org/docs/latest-v14.x/api/errors.html#errors_node_js_error_codes" target="_blank" rel="noopener noreferrer">https://nodejs.org/docs/latest-v14.x/api/errors.html#errors_node_js_error_codes</a>, specifically in the <code>Common system errors</code> section of that page.</p></li><li><p>Where events are written to log files, they might reside in different logs variously devoted to data processing, cluster communication, or the REST API. (For details, see <a product="stream" href="/stream/3.1.3/monitoring#types-of-logs">Types of Logs</a>.) We note the log type where necessary.</p></li></ul><h2 class="anchor anchorWithStickyNavbar_yP2J" id="web-ui">Web UI<a aria-hidden="true" class="hash-link" href="#web-ui" title="Direct link to heading"></a></h2><p><strong>Where:</strong> In LogStream's UI.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-failed-to-fetch">Error: "Failed to fetch"<a aria-hidden="true" class="hash-link" href="#error-failed-to-fetch" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> This occurs only when accessing <strong>Data</strong> > <strong>Collectors</strong>. It can occur with ad blockers, and occurs with the Brave browser (because the newly loaded page's URL includes the string <code>collector</code>). </p><p><strong>Recommendation:</strong> If you have an ad blocker, allowlist the <code>https://<hostname>:9000/jobs/collectors</code> (single-instance) URL or the <code>https://<masternode>:9000/m/<group_name>/jobs/collectors</code> (Leader) URL.</p><figure class="cribl-image"><div style="width:50%"><div><a class="clickable_zZ3o"><img class="image_y29c lightTheme_Dh1L content-image" src="/assets/images/Screen_Shot_2021-04-12_at_10.32.33_PM-9f51d1c0eb9c40f3a4094e04dfb18d84.png"/><img class="image_y29c darkTheme_g2wh content-image" src="/assets/images/Screen_Shot_2021-04-12_at_10.32.33_PM-9f51d1c0eb9c40f3a4094e04dfb18d84.png"/></a><div tabindex="1" class="modal_O09L hidden_xYRH"><img src="/assets/images/Screen_Shot_2021-04-12_at_10.32.33_PM-9f51d1c0eb9c40f3a4094e04dfb18d84.png"/></div></div></div><figcaption>Failed to fetch</figcaption></figure><h3 class="anchor anchorWithStickyNavbar_yP2J" id="config-helper">Error: "The Config Helper service is not available because a configuration file doesn't exist or the settings are invalid. Please fix it and restart LogStream."<a aria-hidden="true" class="hash-link" href="#config-helper" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> Occurs only on Leader Nodes. Each Worker Group relies on a config helper process that runs on its behalf on a Leader Node, and that process is not currently running. This error is usually triggered by restarting LogStream on the Leader Node, and then trying to access its <strong>Worker Groups</strong> menu (2.x), or <strong>Groups</strong> or <strong>Configure</strong> (3.x) menu, before the LogStream server is up.</p><p><strong>Recommendation:</strong> Try again in a few seconds. If you've made changes to the backend or filesystem permissions, stop LogStream, and make sure the <code>cribl</code> user owns all relevant assets, before restarting: <code>sudo chown -R cribl.cribl /opt/cribl</code></p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="warning-kms-saved-but-secret-exists-in-destination-location-no-data-migrated">Warning: "KMS saved, but secret exists in destination location. No data migrated."<a aria-hidden="true" class="hash-link" href="#warning-kms-saved-but-secret-exists-in-destination-location-no-data-migrated" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> This will appear when you attempt to save KMS Settings with a <strong>Secret Path</strong> entry that references a secret that already exists in HashiCorp Vault. It can also occur with OpenID Connect remote authentication. LogStream has aborted the remote write to avoid overwriting an external shared secret.</p><p><strong>Recommendation:</strong> On the Leader Node, manually edit <code>kms.yml</code> to use <code>provider: local</code>. Then restart LogStream to correct the path conflict.</p><h2 class="anchor anchorWithStickyNavbar_yP2J" id="sources-general">Sources (General)<a aria-hidden="true" class="hash-link" href="#sources-general" title="Direct link to heading"></a></h2><p><strong>Where:</strong> These events will be in the Worker process logs.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-bind-eacces-0000514">Error: "bind EACCES 0.0.0.0:514"<a aria-hidden="true" class="hash-link" href="#error-bind-eacces-0000514" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> LogStream doesn't have proper privileges to bind to the specified IP and port. Usually this simply an issue of LogStream running as a non-root user, but a Source was accidentally configured to use a privileged port below 1024.</p><p><strong>Recommendation:</strong> Check your LogStream Sources' configuration. The error's <code>channel</code> field will indicate which input is affected.</p><figure class="cribl-image"><div style="width:40%"><div><a class="clickable_zZ3o"><img class="image_y29c lightTheme_Dh1L content-image" src="/assets/images/Screen_Shot_2021-04-14_at_11.36.07_PM-ec4c9a13362f8b79a26fcc4b93d4d391.png"/><img class="image_y29c darkTheme_g2wh content-image" src="/assets/images/Screen_Shot_2021-04-14_at_11.36.07_PM-ec4c9a13362f8b79a26fcc4b93d4d391.png"/></a><div tabindex="1" class="modal_O09L hidden_xYRH"><img src="/assets/images/Screen_Shot_2021-04-14_at_11.36.07_PM-ec4c9a13362f8b79a26fcc4b93d4d391.png"/></div></div></div><figcaption>ACCES error</figcaption></figure><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-bind-eaddrinuse-00009514">Error: “bind EADDRINUSE 0.0.0.0:9514”<a aria-hidden="true" class="hash-link" href="#error-bind-eaddrinuse-00009514" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> The interface and port combination is already in use by another process, which might or might not be LogStream.</p><p><strong>Recommendation:</strong> Check your LogStream Sources' configuration. The error's <code>channel</code> field will indicate which Source is affected, but this error means that one or more other inputs are also using the same IP/port combination.</p><figure class="cribl-image"><div style="width:40%"><div><a class="clickable_zZ3o"><img class="image_y29c lightTheme_Dh1L content-image" src="/assets/images/Screen_Shot_2021-04-14_at_11.27.51_PM-10502894d77f9844ec4b06b118a037fa.png"/><img class="image_y29c darkTheme_g2wh content-image" src="/assets/images/Screen_Shot_2021-04-14_at_11.27.51_PM-10502894d77f9844ec4b06b118a037fa.png"/></a><div tabindex="1" class="modal_O09L hidden_xYRH"><img src="/assets/images/Screen_Shot_2021-04-14_at_11.27.51_PM-10502894d77f9844ec4b06b118a037fa.png"/></div></div></div><figcaption>ADDRINUSE error</figcaption></figure><h2 class="anchor anchorWithStickyNavbar_yP2J" id="http-based-source">HTTP-based Source<a aria-hidden="true" class="hash-link" href="#http-based-source" title="Direct link to heading"></a></h2><p>Where: These events will be in the Worker Process logs.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="message-dropping-request-because-token-invalidauthtoken-basnjc-v245-and-later">Message: "Dropping request because token invalid","authToken": "Bas...Njc="" (v2.4.5 and later)<a aria-hidden="true" class="hash-link" href="#message-dropping-request-because-token-invalidauthtoken-basnjc-v245-and-later" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> The specified token is invalid. Note the above message is logged only at debug level.</p><h2 class="anchor anchorWithStickyNavbar_yP2J" id="kafka-based-source">Kafka-based Source<a aria-hidden="true" class="hash-link" href="#kafka-based-source" title="Direct link to heading"></a></h2><p>Where: These events will be in the Worker Process logs.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-kafkajsprotocolerror-not-authorized-to-access-topics-topic-authorization-failed">Error: "KafkaJSProtocolError: Not authorized to access topics: <!-- -->[Topic authorization failed]<!-- -->"<a aria-hidden="true" class="hash-link" href="#error-kafkajsprotocolerror-not-authorized-to-access-topics-topic-authorization-failed" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> The username does not have read permissions for the specified topic.</p><h2 class="anchor anchorWithStickyNavbar_yP2J" id="splunk-tcp-source">Splunk TCP Source<a aria-hidden="true" class="hash-link" href="#splunk-tcp-source" title="Direct link to heading"></a></h2><p>Where: These events will be in the Worker Process logs.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-connection-rejected-with-a-reason-of-too-many-connections">Error: "connection rejected" with a <code>reason</code> of "Too many connections"<a aria-hidden="true" class="hash-link" href="#error-connection-rejected-with-a-reason-of-too-many-connections" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> The maximum number of active Splunk TCP connections has been exceeded per worker process. The default is 1000.</p><p><strong>Recommendation:</strong> In the Splunk TCP input's Advanced Settings configuration, increase the Max Active Connections value, set it to 0 for unlimited, and/or increase the # of worker processes the Worker Node(s) are using..</p><h2 class="anchor anchorWithStickyNavbar_yP2J" id="splunk-hec-source">Splunk HEC Source<a aria-hidden="true" class="hash-link" href="#splunk-hec-source" title="Direct link to heading"></a></h2><p>Where: These events will be in the Worker Process logs.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-malformed-hec-event">Error: "Malformed HEC event"<a aria-hidden="true" class="hash-link" href="#error-malformed-hec-event" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> The event is missing both <code>event</code> and <code>fields</code> fields.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-invalid-token">Error: "Invalid token"<a aria-hidden="true" class="hash-link" href="#error-invalid-token" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> Auth token(s) are defined, but the token specified in the HEC request doesn't match any defined tokens, therefore it's invalid.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-invalid-index">Error: "Invalid index"<a aria-hidden="true" class="hash-link" href="#error-invalid-index" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> The Splunk HEC Source's <strong>Allowed Indexes</strong> field is configured with specific indexes, but the client's HTTP request didn’t specify any of them.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-textserver-is-busycode9invalid-event-number0">Error: "{"text":"Server is busy","code":9,"invalid-event-number":0}"<a aria-hidden="true" class="hash-link" href="#error-textserver-is-busycode9invalid-event-number0" title="Direct link to heading"></a></h3><p><strong>Note</strong>: This is not logged in LogStream, but would be found in the response payload sent to your HEC client.</p><p><strong>Cause:</strong> "Server is busy" is the equivalent of a 503 HTTP response code. The most likely cause is the <strong>Max active requests</strong> setting in the HEC input's Advanced Settings is insufficient to service the number of simultaneous HEC requests. Increase the value and monitor your clients to see if the 503 response is eliminated.</p><h2 class="anchor anchorWithStickyNavbar_yP2J" id="tls-errors">TLS Errors<a aria-hidden="true" class="hash-link" href="#tls-errors" title="Direct link to heading"></a></h2><p><strong>Where:</strong> These events can be in Worker Process or API logs on the Workers or Leader, depending on whether the issue is associated with a Source or Destination, etc.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-certificate-has-expired">Error: “certificate has expired”<a aria-hidden="true" class="hash-link" href="#error-certificate-has-expired" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> <strong>Validate server certs</strong> or <strong>Validate client certs</strong> is enabled, and the peer's certificate has expired.</p><p><strong>Recommendation:</strong> Disable <strong>Validate server certs</strong> or <strong>Validate client certs</strong> (depending on whether LogStream is serving as the client or server), so that encryption can still occur without authentication. Or renew the expired certificate.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-client-network-socket-disconnected-before-secure-tls-connection-was-established">Error: “Client network socket disconnected before secure TLS connection was established”<a aria-hidden="true" class="hash-link" href="#error-client-network-socket-disconnected-before-secure-tls-connection-was-established" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> Typically caused by a TLS protocol version mismatch between the client and server.</p><p><strong>Recommendation:</strong> Verify that client's and server's TLS settings use the same minimum/maximum TLS version.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-unable-to-get-local-issuer-certificate">Error: “Unable to get local issuer certificate”<a aria-hidden="true" class="hash-link" href="#error-unable-to-get-local-issuer-certificate" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> Client can’t validate the server certificate’s CA (i.e., the issuer) because it doesn’t trust the CA cert. Or vice versa (server can't validate client's certificate CA) if mutual auth is enabled.</p><p><strong>Recommendation:</strong> The CA certificates used by the server's leaf certificate must be trusted by the client. See <a product="stream" href="/stream/3.1.3/securing-and-monitoring#env-vars">Configuring CA certs</a>.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-self-signed-certificate">Error: “self signed certificate”<a aria-hidden="true" class="hash-link" href="#error-self-signed-certificate" title="Direct link to heading"></a></h3><p><strong>Cause:</strong> The client or server was presented with a self-signed cert from the peer, but that cert is not trusted.</p><p><strong>Recommendation:</strong> The self-signed certificate must be trusted by the peer to which it's presented. See <a product="stream" href="/stream/3.1.3/securing-and-monitoring#env-vars">Configuring CA certs</a>.</p><h3 class="anchor anchorWithStickyNavbar_yP2J" id="error-hostnameip-does-not-match-certificates-altnames">Error: “Hostname/IP does not match certificate’s altnames"<a aria-hidden="true" class="hash-link" href="#error-hostnameip-does-not-match-certificates-altnames" title="Direct link to heading"></a></h3><p><strong>Variations:</strong> “Hostname/IP does not match certificate’s altnames: host: <!-- --><<!-- -->server hostname<!-- -->><!-- --> is not in the cert’s list”
推荐文章
温暖的啄木鸟
·
诗意千重话郴州-新华每日电讯
6 天前
读研的水煮鱼
·
trust(html) - Mithril 中文文档,中文教程
1 周前
失望的鸵鸟
·
今天终于拿到了极米h5投影仪,迫不及待地使用,折腾了一下午,投影效果实在惊艳,看4k视频简直就是视觉享受,纤毫毕现!非常... - 雪球
1 月前
谦虚好学的消防车
·
Excel中关于“&”的用法你知道多少?
2 月前
风度翩翩的镜子
·
【【专家观点】发展新质生产力要突出因地制宜】-国家发展和改革委员会
4 月前