Cribl Stream vs rsyslog

Cribl Stream processes machine data such as logs, instrumentation, application data and metrics in real time, then delivers it to an analysis platform. It can add external context, redact, obfuscate or encrypt sensitive fields, and optimize data for performance and cost requirements. Pipelines built from Functions transform incoming events, while Routes direct events to Pipelines and Destinations. Cribl says Stream connects to more than 80 data sources and destinations and supports Cribl Packs for integrations. The Copilot Editor accepts plain-language prompts to help build and refine pipelines, transform and enrich data, filter noise, and route telemetry. Stream can run on Cribl-managed cloud infrastructure or on customer infrastructure, Kubernetes Pods or containers. The Free plan costs nothing and supports up to 1TB per day, unlimited Pipelines and Routes, and Community Support; the on-prem Free license requires sending anonymized telemetry to Cribl. Standard and Enterprise are billed by credits used at ingest, with no prices listed. Cribl was founded in 2018.

rsyslog is a self-hosted engine for collecting, transforming and routing event data, with a processing model built from inputs, rulesets and actions. The project says it can deliver over one million messages per second to local destinations when processing is limited. Reliability features include on-demand disk spooling, backup destinations and multiple processing threads. Documented outputs include Elasticsearch, OpenSearch, Apache Kafka, HTTP endpoints and syslog forwarding. Database outputs cover MariaDB/MySQL and PostgreSQL, with libdbi support for other databases. TLS-protected syslog and forwarding with peer authentication settings are documented. The core programs use GPLv3, while some runtime files use LGPL. rsyslog is developed for Linux, POSIX and related UNIX-like systems, and is available through source, Git, distribution packages and Docker. It does not run natively on Windows; a separate Windows Agent collects Event Logs and local log files and can relay syslog to rsyslog on Linux. The core software is free; paid support is available from €1,999/yr.