LoginSign Up
← Back to all sparks
F

Fluent Bit

ANALYTICS
Velocity5.0

Lightweight telemetry and log processor and forwarder

fluentbit.io ↗

Fluent Bit spends October bounding what its inputs will accept.

observabilityloggingsecurity-hardeningopentelemetrykubernetes
◆Current state
Fluent Bit's last three 5.1 releases are mostly hardening. 5.1.3 validates OTLP log protobuf depth and fixes out_s3 heap corruption; 5.1.4 limits OTLP gRPC decompression and budgets msgpack objects on forward input; 5.1.5 bounds MessagePack reads into Lua and mitigates CRLF injection in HTTP headers. Features still land between them, including protobuf for the Kafka schema registry, a CRL file option for TLS and Chronicle API support. 5.0.x is taking backports only.
◆Where it's heading
The pattern has shifted from the depth-first feature work on GCS and eBPF in August and September to input safety across the agent. The mitigations cover many separate plugins rather than one bad component, which reads as a systematic audit of untrusted data paths. Fluent Bit sits on the path of data it does not control, which is where a collector's risk lies.
◆Prediction
Expect further releases on the same pattern, mixing mitigations with connector additions. The eBPF trace expansion noted earlier does not appear in these notes, so its next step is unclear.

◆Recent moves

  1. 12d ago

    5.1.5 bounds Lua reads and mitigates CRLF header injection

    5.1.5 is the broadest of the hardening releases: bounded Lua reads, forward and collectd decoding fixes, CRLF injection mitigated in the HTTP client and Loki output, and JWTs concealed from debug logs. It also adds Chronicle API support and PATCH on out_http.

    View source ↗
  2. 17d ago

    5.1.4 limits OTLP decompression and msgpack unpacking

    Continues the input-safety run by limiting OTLP gRPC decompression, budgeting msgpack objects and bounding Kubernetes filter tags. It also enforces the multiline buffer limit for EQ and ENDSWITH types.

    View source ↗
  3. 24d ago

    5.0.11: winevtlog crash fix and Kafka packaging backports

    A small backport to the 5.0 line: a Windows event log crash fix and packaging changes that enable Kafka plugins on CentOS Stream 9 and 10.

    View source ↗
  4. 1mo ago

    5.1.3: Kafka protobuf schemas, TLS CRL files, S3 crash fix

    A mixed release that starts the shift to input safety while still adding capability: protobuf for the Kafka schema registry, tls.crl_file, an ArvanCloud output and a metric age filter, plus out_s3 heap corruption and GCS crash fixes.

    View source ↗
  5. 1mo ago

    Fluent Bit 5.1.2: GCS Parquet compression and WIF support

    5.1.2 is the largest 5.1.x drop so far, adding Parquet compression and Workload Identity Federation to the GCS output, namespace-scoped systemd capture, Kubernetes namespace exclusion in the filter, and a built-in JSON multiline parser — extending the 5.x capability surface across cloud storage and Kubernetes-native use cases. The macOS stat and thermal metrics rounding out the node exporter fit the same pattern of closing platform gaps rather than introducing new directions.

    View source ↗
  6. 1mo ago

    Fluent Bit 5.0.10: maintenance backports

    5.0.10 is a backport-only release, cherry-picking TLS retry, Windows event log enrichment, Avro/Kafka, and a batch of maintenance fixes from 5.1 onto the stable 5.0 branch. No net-new capability — this is the stable channel getting the fixes that landed in 5.1 upstream.

    View source ↗