At a glance
- Deployment
- saas, self-hosted, hybrid
- Licence
- proprietary
- Categories
- telemetry pipeline, data lake, log management, instrumentation
- Ownership
- private
- Estimate
- Costed from published list prices
- Vendor-side sampling
- unknown
What it charges for
Every line item recorded for Cribl. "Not stated" means the vendor's own page gives no number; it is never treated as zero.
| Line item | Unit | Commitment | List price | Sources |
|---|---|---|---|---|
| Cribl for Startups credits | credit | startup programme (Cribl's discretion) | Not stated | s_startups |
| Cribl Credit | credit | annual prepaid pool, minimum commitment for new/renewing Cloud customers | $1 | s_pguide, s_pricing |
| Stream ingest, Cloud Worker (Enterprise) | gb-ingested | draws from credit pool | $0.32 | s_pguide, s_stream_price |
| Stream ingest, Cloud Worker (Standard) | gb-ingested | draws from credit pool; Standard plan capped at 5 TB/day | $0.27 | s_stream_price |
| Stream ingest, Hybrid Worker (Enterprise) | gb-ingested | draws from credit pool | $0.26 | s_pguide, s_stream_price |
| Cloud Worker infrastructure | custom | draws from credit pool, hourly | Not stated | s_pguide |
| Edge ingest | gb-ingested | draws from credit pool | $0.21 | s_pguide |
| Cribl Guard (sensitive-data detection) | gb-processed | draws from credit pool | $0.15 | s_pguide |
| Lake storage, Cribl-managed | gb-retained-month | draws from credit pool | $0.05 | s_lake_price, s_pguide |
| Lake storage, BYOS (self-managed bucket) | gb-retained-month | draws from credit pool | $0.02 | s_pguide |
| Lake Direct Access ingest | gb-ingested | draws from credit pool | $0.1 | s_lake_price, s_pguide |
| Search consumption (compute) | custom | draws from credit pool | $1 | s_pguide |
| Search federated engine, Nano | flat-month | monthly tier, resizable any time | $452 | s_search_price |
| Search federated engine, Micro | flat-month | monthly tier | $904 | s_search_price |
| Search federated engine, X-Small | flat-month | monthly tier | $1,808 | s_search_price |
| Search federated engine, Small | flat-month | monthly tier | $3,436 | s_search_price |
| Search federated engine, Medium | flat-month | monthly tier | $6,531 | s_search_price |
| Search federated engine, Large | flat-month | monthly tier | $12,410 | s_search_price |
| Search federated engine, X-Large | flat-month | monthly tier | $23,580 | s_search_price |
| Lakehouse engine (Small to 2XL) | flat-month | monthly tier by GB/day capacity | Not stated | s_pguide, s_search_price |
| Self-managed license, Stream or Edge, up to 500 GB/day | custom | 12-month license by peak daily ingest | $50,000 | s_pguide |
| Self-managed license, Stream or Edge, up to 1 TB/day | custom | 12-month license by peak daily ingest | $84,000 | s_pguide |
| Self-managed license, Guard, up to 500 GB/day scanned | custom | 12-month license by daily scan volume | $29,000 | s_pguide |
| Self-managed license, Guard, up to 1 TB/day scanned | custom | 12-month license by daily scan volume | $48,000 | s_pguide |
How the estimate is built
The standard deployment is priced by these components (methodology). A quantity is a formula over the workload variables; free allowances are subtracted first, and a tier prices only its own band.
| Component | Line item | Quantity | Free | Tier |
|---|---|---|---|---|
| Stream ingest, Cloud Workers (logs and spans) | Stream ingest, Cloud Worker (Enterprise) · per gb-ingested · draws from credit pool | log_gb + span_gb | ||
| Cloud Worker infrastructure (hourly, sized by MB/s) | Cloud Worker infrastructure · per custom · draws from credit pool, hourly | hours |
Example monthly bills
The same four illustrative workloads as the calculator, at list price. "At least" means a price the vendor does not state is left out of the total.
| Workload | Per month | Note | Calculator |
|---|---|---|---|
| Starter | ≥ $29.41 | At least; no stated price for Cloud Worker infrastructure (hourly, sized by MB/s) | Open Starter in the calculator→ |
| Small | ≥ $294 | At least; no stated price for Cloud Worker infrastructure (hourly, sized by MB/s) | Open Small in the calculator→ |
| Medium | ≥ $5,887 | At least; no stated price for Cloud Worker infrastructure (hourly, sized by MB/s) | Open Medium in the calculator→ |
| Large | ≥ $58,874 | At least; no stated price for Cloud Worker infrastructure (hourly, sized by MB/s) | Open Large in the calculator→ |
Capabilities
What Cribl offers, by the definitions in the dataset. Add-on means a separately priced product.
| Capability | Level | Sources |
|---|---|---|
| Ai assistant nl query Natural-language query or chat assistant | Yes | s_copilot_kql |
| Alerting Alert rules with routing/notification | Partial | s_pricing |
| Data reduction Drop, aggregate, dedupe, or convert logs-to-metrics before billing | Yes | s_pguide |
| Federated search Query data in place (object storage, other tools) without ingesting | Yes | s_pguide, s_pricing_2026_10, s_search_price, s_search_price_2026_10 |
| Fedramp FedRAMP authorized (state level in note) | Yes | s_fedramp |
| Llm observability LLM/agent tracing, token and cost tracking, evaluations | Partial | s_llm |
| Logs Log management | Yes | s_pguide |
| Mcp server Exposes an MCP server for agents | Yes | s_mcp |
| Metrics Metrics | Partial | s_otel, s_prw |
| Multi destination routing Route one stream to several third-party destinations | Yes | s_pguide, s_stream_price |
| Observability as code Terraform provider / dashboards-and-alerts as code | Yes | s_tf |
| Open format archive Archive in an open format (Parquet, JSON, OTLP) in customer object storage | Yes | s_pguide |
| Otlp ingest Accepts OTLP (gRPC or HTTP) natively, without a proprietary agent in the path | Yes | s_otel |
| Persistent queue Disk-backed buffering and retry under backpressure | Yes | s_otel, s_prw |
| Pii redaction Mask/redact sensitive data in the pipeline | Yes | s_guide, s_pguide |
| Pipeline processing Parse, enrich, transform in flight before storage | Yes | s_guide, s_pguide |
| Prometheus remote write Accepts Prometheus remote_write | Yes | s_prw |
| Proprietary agent required Full functionality needs the vendor's own agent (yes = lock-in signal) | No | s_otel, s_sources |
| Rbac Role-based access control | Partial | s_pricing |
| Rehydration Re-ingest archived data for search on demand | Yes | s_lake_price |
| Saas Vendor-hosted SaaS | Yes | s_pricing |
| Self hosted Customer can run it on its own infrastructure | Partial | s_pguide |
| Sso saml SSO via SAML/OIDC | Partial | s_pricing |
| Tiered storage Hot/warm/cold or archive tiers priced differently | Yes | s_lake_price, s_pguide |
| Traces Distributed tracing | Partial | s_apm_app, s_otel |
| Usage cost controls Quotas, budgets, usage attribution to teams | Yes | s_pguide |
Sources
Every page cited above, with the date it was read. Third-party pages are marked; a price stated only by a third party is shown as not stated.
Spotted a wrong price? A way to report one is not set up yet.