All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Allow plugin parameters to have a default value even if they are required
- Updated version of stanza used in several isolated modules
timestamp
parser now supports alocation
parameter
k8s_metadata_decorator
using a proxy causes internal API timeout
file_input
exclude processing could result in extra exclusions
- Ability to customize
file_input
'sfingerprint_size
- Issue where timestamps ending 'Z' were not treated as UTC
- Issue where recognized timezones may not properly calculate offsets
- Issue where
file_output
would escape html special characters
- Issue where flushers would retry indefinitely
- Issue where flushers would improperly reuse the same http request multiple times
- Recombine operator to combine multiline logs after ingestion and parsing
- Issue where entries skipped by
if
would be output twice
- New operators
forward_output
andforward_input
to easily send log entries between stanza instances. - Override default timestamp with
STANZA_DEFAULT_TIMESTAMP
for integration testing - Add new
bytesize
type for easier configuration of byte sizes - Automatic severity promotion in the syslog parser
- Open files in chunks so that we don't hit open file limit and cause performance issues
- New parameter
if
to parser plugins to allow for easy conditional parsing without routers - New
default
parameter to the router to explicitly send unmatched entries to a specific operator(s)
- Missing default configuration of
elastic_output
flusher
- A plugin that fails to parse will now log an error, but will not cause stanza to fail to start
- New
stdin
operator
- OTLP severity level recognition
- Severity Text field on Entry
- Removed
preserve
in favor ofpreserve_to
to make it more clear that it may overwrite parsed fields - Updated our internal log sampling numbers to more aggressively sample repeated logs
- Log message whenever a new file is detected
windows_eventlog_input
can now parse messages from the Security channel.
- Router outputs were not namespaced correctly
- (De)serialization of JSON for plugin config structs
- New Relic Logs output operator
- Additional resource values with parent object names (service name, replica set name, etc.) in the k8s metadata operator
- Publicly available
version.GetVersion()
for consumers of thestanza
module
- Most operators are no longer part of dedicated modules
- File input improvements and rotation tests
- Disk buffer for output operators (PR109)
- Split buffers into buffers and flushers for better modularity (PR109)
- New memory buffer design for a uniform interface between disk and memory buffers (PR109)
- Most operators are now dedicated modules, so that they may be imported individually (PR108)
- Rendering issue with the
kubernetes_events
plugin
- Support for accessing the resource with fields (PR105)
- Support for using fields to select keys that contain dots like
$record['field.with.dots']
(PR105) google_cloud_output
will use resource create a monitored resource for supported resource types (currently only k8s resources) (PR105)
- The operators
host_metadata
,k8s_event_input
, andk8s_metadata_decorator
will now use the top-level resource field (PR105) k8s_metadata_decorator
now generates pod labels that match those generated by GKE (PR105)
- Issue with
k8s_event_input
generating entries with zero-valued time (PR105) - Plugin ID in templates will now correctly default to the plugin type if unset (PR105)
- Agent is now embeddable with a default output
- The 'filter' operator
- Renamed project to
stanza
- Move
testutil
package out ofinternal
- The
Resource
field was added to Entry (PR95) - The
Identifier
helper was created to assist with writing toResource
(PR95)
- The
Tags
field was removed from Entry (PR95)
- The
host_metadata
operator now writes to an entry'sResource
field, instead of Labels - The
host_labeler
helper has been renamedhost_identifier
- The
metadata
operator embeds theIdentifier
helper and supports writing toResource
- Input operators embed the
Identifier
helper and support writing toResource
- The
k8s_event
operator now supports thewrite_to
,labels
, andresource
configuration options - Multiline for
file_input
now supports matching on new lines characters (PR96)
- Kubernetes events input operator (PR88)
- Small improvements to test stability
- Fallback to reflection to convert entries to Google Cloud log entries (PR93)
- Google Cloud Output failure when sent a field of type uint16 (PR82)
- Added a default function to plugin templates (PR84)
- Add a host metadata operator that adds hostname and IP to entries (PR85)
- Google Cloud Output option to enable gzip compression (PR86)
- In the file input operator, file name and path fields are now added with
include_file_name
(defaulttrue
) andinclude_file_path
(defaultfalse
) - Input and router operators can define labels on entries using the
labels
field - Add Event ID to windows event log entries
- Use the
go-syslog
fork directly rather than relying on areplace
directive so that the agent can be used as a library successfully
- Fork go-syslog to support long sdnames that are not rfc5424-compliant
- Reduce noise in debug messages for TCP and UDP inputs
log_type
label added by default to input operators
- Trim carriage returns from TCP input
- Configurable
timeout
parameter for thek8s_metadata_decorator
(PR54) - Journald operator now supports
start_at
parameter (PR55)
- Enhanced plugin parameter metadata structure, to support required/optional and default values (PR59)
- Issue where multiple instances of
syslog_parser
would cause parsing errors (PR61) short destination buffer
error now is handled by increasing encoding buffer size (PR58)- Issue where omitting the output field in a plugin could result in errors (PR56)
- Allow omitting
id
, defaulting to plugin type if unique within namespace - Allow omitting
output
, defaulting to the next operator in the pipeline if valid
- Support for multiple encodings in the file input plugin (PR39)
- Install scripts and docker image now include plugins from
stanza-plugins
repository (PR45) - Publish image to dockerhub (PR42)
- Improved default configuration (PR41)
- Basic developer documentation (PR43)
- JournalD emits
map[string]interface{}
(PR38)
- Link
stanza
into/usr/local/bin
so it's available on most users'PATH
(PR28) - New parameter
file_name_path
to the file input plugin for cases when just the file name is needed
- Renamed
path_field
tofile_path_field
in the file input plugin
- Failure in Google Cloud Output to convert some data types to protocol buffers
- Writing from files being actively written to will sometimes read partial entries (PR21)
- Minor documentation omissions
- Initial open source release. See documentation for full list of supported features in this version.