FerroStash Container

Container build of FerroStash. Deploy the Rust-native, Logstash-compatible log and event pipeline as a single static binary on Amazon EKS via the included Helm chart. Implements the production-common subset of Logstash 9.x bundled plugins (98 of 111, ~88%), parses the `pipeline.conf` DSL natively, no JVM, milliseconds to start. Metered per pod-hour.

Where a typical Logstash pipeline holds about a gigabyte of JVM heap and takes tens of seconds to start, FerroStash Container runs a single Rust binary as an EKS pod. It is the same v1.0-line binary as the AMI build and covers ~88% of the bundled Logstash 9.x plugins — inputs include beats, file, tcp, udp, http, syslog, kafka, redis, s3, sqs, jdbc, elasticsearch, and cloudwatch; filters include grok, dissect, kv, json, mutate, date, geoip, dns, csv, xml, useragent, cidr, fingerprint, translate, aggregate, throttle, and a native Painless-style script; outputs include elasticsearch / opensearch, kafka, s3, http, tcp, udp, file, redis, sqs, sns, cloudwatch, email, and datadog; codecs include json, json_lines, multiline, cef, netflow, avro, msgpack, and protobuf — driven by a templated `pipeline.conf` rendered into a `ConfigMap`. The Helm chart exposes Elastic Beats on tcp/5044 and the monitoring API on tcp/9600. The container verifies entitlement via `RegisterUsage` at startup, excludes the optional `ruby` filter, and is supported in a single-node topology. Honest scope: it is Logstash config/pipeline compatible, not a byte-identical 100% drop-in.

Highlights