{"slug":"integrate-cribl-with-aperture","title":"Integrate Cribl with Aperture","tags":["tailscale"],"agent_summary":"Last validated: Apr 9, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Integrate Cribl with Aperture\r\n\r\nLast validated: Apr 9, 2026\r\n\r\nAperture by Tailscaleis currently [in alpha](https://tailscale.com/docs/reference/tailscale-release-stages#alpha).\r\n\r\n[Cribl](https://cribl.io/) is a data pipeline platform that routes, reduces, and enriches observability data. By connecting Aperture to Cribl, you can route AI usage data through your existing Cribl pipelines and forward it to any of Cribl's supported destinations (Splunk, Datadog, S3, and others).\r\n\r\nAperture sends data to Cribl using the [hooks system](https://tailscale.com/docs/aperture/configuration#hooks). You configure a webhook endpoint in Cribl, then add a hook in Aperture that sends event data to that endpoint when requests match your grant conditions.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/aperture/how-to/integrate-cribl\\#prerequisites)\r\n\r\nBefore you begin, ensure you have the following:\r\n\r\n- A running [Aperture instance](https://tailscale.com/docs/aperture/get-started) accessible from your device.\r\n- A [Cribl Stream or Cribl Cloud](https://cribl.io/) deployment with a configured [webhook source](https://docs.cribl.io/stream/sources-webhook/).\r\n\r\n## [Configure the Cribl webhook source](https://tailscale.com/docs/aperture/how-to/integrate-cribl\\#configure-the-cribl-webhook-source)\r\n\r\nGet the webhook URL and authentication token from your Cribl deployment. You'll use these to configure a hook in Aperture that sends data to Cribl.\r\n\r\n1. In your Cribl deployment, create a webhook source to receive data from Aperture.\r\n2. Note the webhook URL and any authentication token Cribl provides. You'll use these when configuring the hook in Aperture.\r\n\r\nFor details on configuring webhook sources in Cribl, refer to the [Cribl documentation](https://docs.cribl.io/).\r\n\r\n## [Configure the Aperture hook](https://tailscale.com/docs/aperture/how-to/integrate-cribl\\#configure-the-aperture-hook)\r\n\r\nTo integrate Cribl with Aperture, configure a hook in Aperture that points to your Cribl endpoint. This lets you send request data to Cribl for processing and routing.\r\n\r\n1. Open the Aperture dashboard at `http://ai/ui/`.\r\n\r\n2. Go to the **Settings** page and open the JSON editor.\r\n\r\n3. Add a `cribl` entry in the `hooks` section with the webhook URL from your Cribl source.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\n\"hooks\": {\r\n \"cribl\": {\r\n \"url\": \"YOUR_CRIBL_WEBHOOK_URL\",\r\n \"apikey\": \"YOUR_CRIBL_AUTH_TOKEN\"\r\n }\r\n}\r\n```\r\n\r\n\r\n\r\nReplace `YOUR_CRIBL_WEBHOOK_URL` with the URL of your Cribl webhook source and `YOUR_CRIBL_AUTH_TOKEN` with the authentication token from Cribl.\r\n\r\n4. Add a grant with a `send_hooks` entry that references the `cribl` hook. The grant controls which requests trigger the hook and what data Aperture sends.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"*\"],\\\r\n \"app\": {\\\r\n \"tailscale.com/cap/aperture\": [\\\r\n {\\\r\n \"send_hooks\": [\\\r\n {\\\r\n \"name\": \"cribl\",\\\r\n \"events\": [\"entire_request\"],\\\r\n \"send\": [\"tools\", \"estimated_cost\", \"request_body\", \"response_body\"]\\\r\n }\\\r\n ]\\\r\n }\\\r\n ]\\\r\n }\\\r\n }\\\r\n]\r\n```\r\n\r\n\r\n\r\nThis configuration sends data for every request from all users. Adjust the `events` and `send` fields based on what data you want to route through Cribl. To limit which users' requests trigger the hook, replace `\"*\"` in the `src` field with specific user identities or tags.\r\n\r\n5. Save the configuration.\r\n\r\n\r\nFor details on hook events and send types, refer to the [hooks configuration reference](https://tailscale.com/docs/aperture/configuration#hooks).\r\n\r\n## [Verify the integration](https://tailscale.com/docs/aperture/how-to/integrate-cribl\\#verify-the-integration)\r\n\r\nAfter configuring the Cribl hook, verify that Aperture is sending data to Cribl and that Cribl is routing it to the expected destination.\r\n\r\n1. Send a request through Aperture that matches your grant conditions.\r\n2. Check your Cribl deployment to confirm the event data arrives at the webhook source.\r\n3. Verify that your Cribl pipeline routes the data to the expected destination.\r\n\r\nIf data doesn't appear, check that the `send_hooks` name matches the key in your `hooks` section and that the grant's `src` field includes the user who made the request.\r\n\r\n## [Next steps](https://tailscale.com/docs/aperture/how-to/integrate-cribl\\#next-steps)\r\n\r\n- [Build a custom webhook](https://tailscale.com/docs/aperture/how-to/build-custom-webhook) to send Aperture data to other services.\r\n- Learn about hook events and data types in the [configuration reference](https://tailscale.com/docs/aperture/configuration#hooks).\r\n- Explore other [external integrations](https://tailscale.com/docs/aperture/integrate) for Aperture.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Integrate Cribl with Aperture

\n

Last validated: Apr 9, 2026

\n

Aperture by Tailscaleis currently in alpha.

\n

Cribl is a data pipeline platform that routes, reduces, and enriches observability data. By connecting Aperture to Cribl, you can route AI usage data through your existing Cribl pipelines and forward it to any of Cribl's supported destinations (Splunk, Datadog, S3, and others).

\n

Aperture sends data to Cribl using the hooks system. You configure a webhook endpoint in Cribl, then add a hook in Aperture that sends event data to that endpoint when requests match your grant conditions.

\n

Prerequisites

\n

Before you begin, ensure you have the following:

\n\n

Configure the Cribl webhook source

\n

Get the webhook URL and authentication token from your Cribl deployment. You'll use these to configure a hook in Aperture that sends data to Cribl.

\n
    \n
  1. In your Cribl deployment, create a webhook source to receive data from Aperture.
    2. \n
  2. Note the webhook URL and any authentication token Cribl provides. You'll use these when configuring the hook in Aperture.
    3. \n
\n

For details on configuring webhook sources in Cribl, refer to the Cribl documentation.

\n

Configure the Aperture hook

\n

To integrate Cribl with Aperture, configure a hook in Aperture that points to your Cribl endpoint. This lets you send request data to Cribl for processing and routing.

\n
    \n
  1. \n

    Open the Aperture dashboard at http://ai/ui/.

    \n
    2. \n
  2. \n

    Go to the Settings page and open the JSON editor.

    \n
    3. \n
  3. \n

    Add a cribl entry in the hooks section with the webhook URL from your Cribl source.

    \n
    4. \n
\n
\"hooks\": {\r\n       \"cribl\": {\r\n           \"url\": \"YOUR_CRIBL_WEBHOOK_URL\",\r\n           \"apikey\": \"YOUR_CRIBL_AUTH_TOKEN\"\r\n       }\r\n}\n
\n

Replace YOUR_CRIBL_WEBHOOK_URL with the URL of your Cribl webhook source and YOUR_CRIBL_AUTH_TOKEN with the authentication token from Cribl.

\n
    \n
  1. Add a grant with a send_hooks entry that references the cribl hook. The grant controls which requests trigger the hook and what data Aperture sends.
    2. \n
\n
\"grants\": [\\\r\n       {\\\r\n           \"src\": [\"*\"],\\\r\n           \"app\": {\\\r\n               \"tailscale.com/cap/aperture\": [\\\r\n                   {\\\r\n                       \"send_hooks\": [\\\r\n                           {\\\r\n                               \"name\": \"cribl\",\\\r\n                               \"events\": [\"entire_request\"],\\\r\n                               \"send\": [\"tools\", \"estimated_cost\", \"request_body\", \"response_body\"]\\\r\n                           }\\\r\n                       ]\\\r\n                   }\\\r\n               ]\\\r\n           }\\\r\n       }\\\r\n]\n
\n

This configuration sends data for every request from all users. Adjust the events and send fields based on what data you want to route through Cribl. To limit which users' requests trigger the hook, replace \"*\" in the src field with specific user identities or tags.

\n
    \n
  1. Save the configuration.
    2. \n
\n

For details on hook events and send types, refer to the hooks configuration reference.

\n

Verify the integration

\n

After configuring the Cribl hook, verify that Aperture is sending data to Cribl and that Cribl is routing it to the expected destination.

\n
    \n
  1. Send a request through Aperture that matches your grant conditions.
    2. \n
  2. Check your Cribl deployment to confirm the event data arrives at the webhook source.
    3. \n
  3. Verify that your Cribl pipeline routes the data to the expected destination.
    4. \n
\n

If data doesn't appear, check that the send_hooks name matches the key in your hooks section and that the grant's src field includes the user who made the request.

\n

Next steps

\n\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}