LoginSign Up
← Back to all sparks
F

Fluentd

INFRA · APIS
Velocity0.0

Unified logging layer for collecting and routing log data

www.fluentd.org ↗

Fluentd's newest line spent its last release hardening the paths that accept untrusted data.

log-collectorinput-validationzstddual-branchruby-compatibility
◆Current state
Two branches are live: 1.19.x carries features and 1.16.x takes occasional single-fix backports. The most recent 1.19.3 is a dense correctness release with a distinctly security-shaped batch — strict host validation for dynamic endpoints in out_http, size limits enforced on decompressed payloads in the buffer and HTTP input, strict path boundary validation for tags, and tightened default visibility for config, retry and debug information in the monitor agent.
◆Where it's heading
The feature work landed in 1.19.0 — zstd compression across buffer, out_file, out_forward and in_forward, chunk evacuation when the retry limit is hit, TLS 1.3 in out_http — and everything since has been reliability and input validation. That ordering makes sense for a log collector: the interesting failure modes are decompression bombs, path traversal through tag names, and sockets that never close, not missing features. Ruby 4.0 compatibility work is threaded through the recent releases.
◆Prediction
Expect 1.19.x to keep shipping validation and socket-lifecycle fixes with Ruby 4.0 support consolidating, and 1.16.x to receive only isolated backports.

◆Recent moves

  1. 1mo ago

    Payload size limits, host validation and tag path boundaries

    The hardening release: decompressed payloads now have enforced size limits, dynamic out_http endpoints get strict host validation, tag-derived paths get boundary checks, and the monitor agent no longer exposes config and debug information by default. Four separate ways a log collector could be pushed around by the data it ingests.

    View source ↗
  2. 5mo ago

    Connection timeouts, socket leaks and Ruby 4.0 dependencies

    Adds a timeout to out_forward connection establishment that previously could loop indefinitely, closes request bodies in the HTTP server helper to stop socket leaks, and pulls in the gems Ruby 4.0 needs. Reliability work on the paths that run continuously.

    View source ↗
  3. 7mo ago

    Backport fixes out_forward stalling under TLS

    A single backport to the maintenance branch for output stalling when security settings and TLS are combined on unstable networks, plus a missing Ruby 3.4 gem dependency. The 1.16 line gets one fix at a time.

    View source ↗
  4. 8mo ago

    YAML config gains array parsing

    One functional change — array format parsing in the YAML configuration — with the rest of the release being CI fixes. Small catch-up work on the newer config syntax.

    View source ↗
  5. 10mo ago

    Server helper closes all connections at shutdown

    A single fix ensuring the server plugin helper closes connections on shutdown, plus CI work. Another one-line backport release on the maintenance branch.

    View source ↗
  6. 1y ago

    zstd compression, chunk evacuation on retry limit, TLS 1.3

    The feature release the rest of this window services: zstd as a compression option across buffer, out_file and out_forward with experimental in_forward support, chunk evacuation when the retry limit is reached, and TLS 1.3 in out_http. Compression and retry-exhaustion behaviour are both cost and data-loss levers at log volume.

    View source ↗