FerroStash Container
Rust-native Logstash-compatible container for Amazon EKS
When does this pay back?
Example: $5,000/month in managed observability spend
At $5,000/month in managed observability spend, a conservative 40% reduction is roughly $2,000/mo — gross avoided usage charge before the S4 software fee, EC2, and workload differences.
Estimate your savings
Enter your relevant monthly spend or usage for a rough estimate — no bill upload needed.
Container build of FerroStash. Deploy the Rust-native, Logstash-compatible log and event pipeline as a single static binary on Amazon EKS via the included Helm chart. Implements the production-common subset of Logstash 9.x bundled plugins (98 of 111, ~88%), parses the `pipeline.conf` DSL natively, no JVM, milliseconds to start. Metered per pod-hour.
Where a typical Logstash pipeline holds about a gigabyte of JVM heap and takes tens of seconds to start, FerroStash Container runs a single Rust binary as an EKS pod. It is the same v1.0-line binary as the AMI build and covers ~88% of the bundled Logstash 9.x plugins — inputs include beats, file, tcp, udp, http, syslog, kafka, redis, s3, sqs, jdbc, elasticsearch, and cloudwatch; filters include grok, dissect, kv, json, mutate, date, geoip, dns, csv, xml, useragent, cidr, fingerprint, translate, aggregate, throttle, and a native Painless-style script; outputs include elasticsearch / opensearch, kafka, s3, http, tcp, udp, file, redis, sqs, sns, cloudwatch, email, and datadog; codecs include json, json_lines, multiline, cef, netflow, avro, msgpack, and protobuf — driven by a templated `pipeline.conf` rendered into a `ConfigMap`. The Helm chart exposes Elastic Beats on tcp/5044 and the monitoring API on tcp/9600. The container verifies entitlement via `RegisterUsage` at startup, excludes the optional `ruby` filter, and is supported in a single-node topology. Honest scope: it is Logstash config/pipeline compatible, not a byte-identical 100% drop-in.
Highlights
Helm chart for Amazon EKS included: `pipeline.conf` rendered via a `ConfigMap`, Elastic Beats on tcp/5044 + monitoring API on tcp/9600.
About 88% of Logstash 9.x bundled plugins (98 of 111) in a single Rust binary — no JVM, ms startup, tens of MB of RAM.
Per pod-hour metering with Marketplace fail-closed entitlement: `RegisterUsage` verified at startup. `ruby` filter excluded; supported topology is single-node.
Why it's cheaper
Assumes 10 Pods on an existing EKS cluster running Logstash sidecars, processing 5 TB / month of logs.
- Extra node vCPU / RAM (≈ m5.large × 5)
- $350 / mo
- Monthly total
- $350 / mo
- Extra node vCPU / RAM (negligible, ≈ t3.small × 1)
- $15 / mo
- FerroStash software fee (10 × hourly)
- $45 / mo
- Monthly total
- $60 / mo
Sizing FerroStash Container by sidecar count
| Sidecars | FerroStash software fee | Logstash equivalent extra node cost | Total vs. Logstash sidecars |
|---|---|---|---|
| ~5 Pods | $22 / mo | $175 / mo | $30 / mo (−83%) |
| ~10 Pods | $45 / mo | $350 / mo | $60 / mo (−83%) |
| ~100 Pods | $450 / mo | $3,500 / mo | $600 / mo (−83%) |
Illustrative example. Logstash on JVM needs about 1 GB of heap per Pod, so 10 sidecars effectively require the resource headroom of ~5 m5.large nodes. FerroStash Container uses tens of MB of RAM with millisecond startup, co-locating with existing pods almost for free in extra node cost. The EKS control plane fee is omitted, assuming an existing cluster.
Pricing model
Hourly per-pod software fee billed by AWS + the EC2 nodes in your own EKS cluster. No license keys; entitlement verified via Marketplace `RegisterUsage`.
Other S4 products
S4 — Squished S3
Transparent GPU S3-compression gateway
S4 Logs
Archive CloudWatch Logs to zstd S3
S4 Metrics
Govern CloudWatch metric cardinality