FerroStash

A Rust-native, Logstash-compatible log and event pipeline. It ingests, transforms, and routes events through the same input → filter → output model as Logstash, parsing the Logstash pipeline.conf DSL (and an equivalent YAML form) natively, without a JVM. A single static binary (about 14 MB) starts in milliseconds and holds tens of MB of RAM, so you can pack far more shippers per host.

Where a typical Logstash pipeline holds about a gigabyte of JVM heap and takes tens of seconds to start, FerroStash runs as a single static binary. The v1.0 line implements the production-common subset of the Logstash 9.x plugin set — about 88 percent of the bundled plugins (98 of 111), weighted toward the parsing and filtering hot path. Inputs include beats, file, tcp, udp, http, syslog, kafka, redis, s3, sqs, jdbc, elasticsearch, and cloudwatch; filters include grok, dissect, kv, json, mutate, date, geoip, dns, csv, xml, useragent, cidr, fingerprint, translate, aggregate, and throttle, plus a native Painless-style script filter; outputs include elasticsearch / opensearch, kafka, s3, http, tcp, udp, file, redis, sqs, sns, cloudwatch, email, and datadog; codecs include json, json_lines, multiline, cef, netflow, avro, msgpack, and protobuf. For reliability it offers an optional on-disk persistent queue with at-least-once delivery and a dead-letter queue (opt-in fsync for power-loss durability) and a built-in monitoring API for node and pipeline stats. Honest scope: it is Logstash config/pipeline compatible, not a byte-identical 100 percent drop-in — coverage is plugin-level, a covered plugin may implement a subset of its options, and a config using a missing plugin fails fast at load.

How it works

1. 1

   Runs input → filter → output natively

   FerroStash ingests, transforms, and routes events through the same input → filter → output model as Logstash. It parses the Logstash pipeline.conf DSL (and an equivalent YAML form) natively — without a JVM and without a separate agent runtime — and runs as a single static binary.

2. 2

   Implements the production-common plugins

   The v1.0 line implements 98 of the 111 bundled Logstash 9.x plugins (about 88%), weighted toward the parsing and filtering hot path. It covers the major inputs, filters, outputs, and codecs and includes a native Painless-style script filter. A config that uses a missing plugin fails fast at load, so there is no silent drop.

3. 3

   Reliability and monitoring

   An optional on-disk persistent queue provides at-least-once delivery (read/ack cursor separation, checkpoint-after-output-ack) and a dead-letter queue, with opt-in fsync for power-loss durability. A built-in monitoring API exposes node and pipeline stats.

Highlights

Use cases

FAQ