Changelog is deprecated in favor of using gorelaser changelog. Keeping the changelog around for history sake.
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Added the
xml_parser
operator PR482
- Added the
lazy_quotes
parameter to the csv parser PR472
- Removed OTLP output operator PR470
- Fixed an issue where TLS configuration fails to enable TLS: PR466
- Fixed an incorrect sync call when saving offsets: PR465
- Windows Event Log operator fix for Windows Server 2022: PR456
Fixed a bug when flushing a range from the memory buffer: PR455
This release includes Stanza Plugins v0.0.82
- Key Value Parser: PR426
- Parse
key=value
pairs
- Parse
- Google Output: entry.Resources are now mapped as labels, because Google Cloud Logging does not support custom resources PR425
- File Input: Optimize excluded file detection PR444
- Significant startup time reduction when reading from a directory with 50,000+ files
- File Input: Optimize
delete_after_read
- TCP / UDP Input: Resolve panic when closing nil connection: PR437
- Cloudwatch Input: Do not store pointers on the entry PR445
- Resolves an issue where an expression cannot be used against an entry from Cloudwatch input
- File Input: Resolve issue where doublestar does not correctly detect files PR433
- Ported from otel: open-telemetry/opentelemetry-log-collection#268
- Upgrade from Go 1.16 to 1.17
- AWS Cloudwatch Input: Added abilty to monitor more than one log group PR 420
- File Input: Changed default max files from 1024 to 512 PR 423
Use plugins version 0.0.76
- File Input: Added optional delete_after_read parameter PR 417
- Useful for cleaning up files after they are read. Important when reading from a directory that is constantly adding new files and never modifying old files.
- Can only be used with
start_at: beginning
- Plugins Version 0.0.75
Resolved an issue where journald will omit logs above 4096 bytes PR 414
Added debug logging to journald_input and google_cloud_output operators PR 413
This release includes Stanza Plugins 0.0.72, which includes the new W3C plugin
- File Input: Added optional LabelRegex parameter, for parsing log file headers as labels PR 376
- CSV Parser: Dynamic field names PR 404
- ARM64 Container Image: PR 381
- TCP Input: Minimum TLS version is now configurable: PR 400
- Systemd service: Set
TimeoutSec
PR 402 - Updated dependencies:
- go.uber.org/multierr PR 387
- go.etcd.io/bbolt PR 385
- k8s client PR 377
- k8s.io/api
- k8s.io/apimachinery
- k8s.io/client-go
- github.com/golangci/golangci-lint PR 382
- cloud.google.com/go/logging PR 394
- google.golang.org/grpc PR 383
- github.com/aws/aws-sdk-go PR 395
- golang.org/x/text PR 386
- github.com/antonmedv/expr PR 396
- Docker base image switch to stanza base image PR 393
- 100MB image size reduction
- Pinned package versions
- Resolved an issue where log type is not set correctly when using kubernetes_container plugin and Google output PR 392
- Enabled flatten operator PR 390
- Resolved journald bug introduced in previous patch release (1.1.6) PR 389
- File input: Added optional labels for resolved symlink file name and path PR 364
- CSV Parser: Added optional configuration field
header_delimiter
PR 370
- Journald input: Switched from long running process to polling strategy PR380
- Goflow now includes a string representation of the
proto
field asproto_name
PR 359 - Goflow parse function refactored for significant performance increase PR 361
- Goflow zero values (such as
proto
) are no longer ommited as they are valid values PR 361proto
: 0 representsproto_name
: HOPOPT
- Added license scanner to CI PR 347
- Added Gosec to CI PR 358
- Fixed file input issue that resulted in minor dataloss when log files are rotating symlinks
- Resolved Gosec suggestions
- K8s daemonset example refreshed PR 348
No changes, releasing for Stanza Plugins v0.0.66
- Resolved an issue where empty ip address fields result in failed parsing PR 336
- Log error returned by publisher.Open in
operator/builtin/input/windows/operator.go
PR 334
- Added Goflow operator for receiving Netflow (v5, v9, ipfix) and Sflow PR 332
- Fixed panic during shutdown when Google Cloud Output credential file not found Issue 264
- Fixed bug where logs can be duplicated when a parser has on_error=send PR 330
- Stanza is now a single module PR304
- Make buffer max chunk delay reconfigurable on the fly PR313
- Added optional network metadata labels to tcp / udp operators PR302
- Added AWS Cloudwatch Logs input operator PR289
- Added Move operator PR271
- Added Add operator PR272
- Added Remove operator PR273
- Added Copy operator PR278
- Added Retain operator PR279
- Added Flatten operator PR286
- Renamed Azure Event Hub event_data field to message PR297
- Added doublestar support to File Input PR283
- Added flatten Operator PR 286
- Added Azure Event Hub Operator PR 287
- Added Azure Log Analytics Operator PR 287
- Added float64 to Severity parser's supported types PR 267
- Switched to Go 1.16, from Go 1.14
- Updated syslog operator to v0.1.5
- Google Output will split batched entries if the batch is too large PR 263
- Issue where Google Output does not drop entries that are too big issue 257
- Issue where partially successful flushes were treated as fully successful, operator/buffer/memory.go
- Added new operator
csv_parser
- Added optional
max_buffer_size
parameter to tcp input operator
- Same as 0.13.14, but released with plugins v0.0.48
- Adds TLS support to
vmware_vcenter
andvmware_esxi
- Adds TLS support to
- Added TLS support to tcp input operator pr253
- uri_parser operator for parsing absolute uri, relative uri, and uri query strings
- container image: added package tzdata
- Added optional
location
parameter to Syslog operator pr247 - Updated Google Cloud output version to v0.1.2 pr250
- Allow plugin parameters to have a default value even if they are required
- Updated version of stanza used in several isolated modules
timestamp
parser now supports alocation
parameter
k8s_metadata_decorator
using a proxy causes internal API timeout
file_input
exclude processing could result in extra exclusions
- Ability to customize
file_input
'sfingerprint_size
- Issue where timestamps ending 'Z' were not treated as UTC
- Issue where recognized timezones may not properly calculate offsets
- Issue where
file_output
would escape html special characters
- Issue where flushers would retry indefinitely
- Issue where flushers would improperly reuse the same http request multiple times
- Recombine operator to combine multiline logs after ingestion and parsing
- Issue where entries skipped by
if
would be output twice
- New operators
forward_output
andforward_input
to easily send log entries between stanza instances. - Override default timestamp with
STANZA_DEFAULT_TIMESTAMP
for integration testing - Add new
bytesize
type for easier configuration of byte sizes - Automatic severity promotion in the syslog parser
- Open files in chunks so that we don't hit open file limit and cause performance issues
- New parameter
if
to parser plugins to allow for easy conditional parsing without routers - New
default
parameter to the router to explicitly send unmatched entries to a specific operator(s)
- Missing default configuration of
elastic_output
flusher
- A plugin that fails to parse will now log an error, but will not cause stanza to fail to start
- New
stdin
operator
- OTLP severity level recognition
- Severity Text field on Entry
- Removed
preserve
in favor ofpreserve_to
to make it more clear that it may overwrite parsed fields - Updated our internal log sampling numbers to more aggressively sample repeated logs
- Log message whenever a new file is detected
windows_eventlog_input
can now parse messages from the Security channel.
- Router outputs were not namespaced correctly
- (De)serialization of JSON for plugin config structs
- New Relic Logs output operator
- Additional resource values with parent object names (service name, replica set name, etc.) in the k8s metadata operator
- Publicly available
version.GetVersion()
for consumers of thestanza
module
- Most operators are no longer part of dedicated modules
- File input improvements and rotation tests
- Disk buffer for output operators (PR109)
- Split buffers into buffers and flushers for better modularity (PR109)
- New memory buffer design for a uniform interface between disk and memory buffers (PR109)
- Most operators are now dedicated modules, so that they may be imported individually (PR108)
- Rendering issue with the
kubernetes_events
plugin
- Support for accessing the resource with fields (PR105)
- Support for using fields to select keys that contain dots like
$record['field.with.dots']
(PR105) google_cloud_output
will use resource create a monitored resource for supported resource types (currently only k8s resources) (PR105)
- The operators
host_metadata
,k8s_event_input
, andk8s_metadata_decorator
will now use the top-level resource field (PR105) k8s_metadata_decorator
now generates pod labels that match those generated by GKE (PR105)
- Issue with
k8s_event_input
generating entries with zero-valued time (PR105) - Plugin ID in templates will now correctly default to the plugin type if unset (PR105)
- Agent is now embeddable with a default output
- The 'filter' operator
- Renamed project to
stanza
- Move
testutil
package out ofinternal
- The
Resource
field was added to Entry (PR95) - The
Identifier
helper was created to assist with writing toResource
(PR95)
- The
Tags
field was removed from Entry (PR95)
- The
host_metadata
operator now writes to an entry'sResource
field, instead of Labels - The
host_labeler
helper has been renamedhost_identifier
- The
metadata
operator embeds theIdentifier
helper and supports writing toResource
- Input operators embed the
Identifier
helper and support writing toResource
- The
k8s_event
operator now supports thewrite_to
,labels
, andresource
configuration options - Multiline for
file_input
now supports matching on new lines characters (PR96)
- Kubernetes events input operator (PR88)
- Small improvements to test stability
- Fallback to reflection to convert entries to Google Cloud log entries (PR93)
- Google Cloud Output failure when sent a field of type uint16 (PR82)
- Added a default function to plugin templates (PR84)
- Add a host metadata operator that adds hostname and IP to entries (PR85)
- Google Cloud Output option to enable gzip compression (PR86)
- In the file input operator, file name and path fields are now added with
include_file_name
(defaulttrue
) andinclude_file_path
(defaultfalse
) - Input and router operators can define labels on entries using the
labels
field - Add Event ID to windows event log entries
- Use the
go-syslog
fork directly rather than relying on areplace
directive so that the agent can be used as a library successfully
- Fork go-syslog to support long sdnames that are not rfc5424-compliant
- Reduce noise in debug messages for TCP and UDP inputs
log_type
label added by default to input operators
- Trim carriage returns from TCP input
- Configurable
timeout
parameter for thek8s_metadata_decorator
(PR54) - Journald operator now supports
start_at
parameter (PR55)
- Enhanced plugin parameter metadata structure, to support required/optional and default values (PR59)
- Issue where multiple instances of
syslog_parser
would cause parsing errors (PR61) short destination buffer
error now is handled by increasing encoding buffer size (PR58)- Issue where omitting the output field in a plugin could result in errors (PR56)
- Allow omitting
id
, defaulting to plugin type if unique within namespace - Allow omitting
output
, defaulting to the next operator in the pipeline if valid
- Support for multiple encodings in the file input plugin (PR39)
- Install scripts and docker image now include plugins from
stanza-plugins
repository (PR45) - Publish image to dockerhub (PR42)
- Improved default configuration (PR41)
- Basic developer documentation (PR43)
- JournalD emits
map[string]interface{}
(PR38)
- Link
stanza
into/usr/local/bin
so it's available on most users'PATH
(PR28) - New parameter
file_name_path
to the file input plugin for cases when just the file name is needed
- Renamed
path_field
tofile_path_field
in the file input plugin
- Failure in Google Cloud Output to convert some data types to protocol buffers
- Writing from files being actively written to will sometimes read partial entries (PR21)
- Minor documentation omissions
- Initial open source release. See documentation for full list of supported features in this version.