Changelog
Each version corresponds to a release/<version> tag in the git repository. Versions track the standalone binary,
Debian package, and Docker image artifacts.
0.2.2 — 2026-05-20
Fixed
- Heartbeat no longer force-reconnects idle-but-healthy websockets. The staleness check tracked only event reception, so a successful keepalive ping did not reset the clock. On a quiet controller (few subscriptions, low fabric activity) the connection was torn down and re-established every ~30s in a loop. A successful pong now updates the staleness timestamp, so the connection stays up indefinitely as long as keepalives succeed; reconnect still triggers if the ping itself fails or times out.
0.2.1 — 2026-05-19
Added
- Per-subscriber include/exclude filtering. Cost-sensitive sinks (
datadog.logs,splunk,otel.logs,elasticsearch,s3,raw_http) now accept optionalincludeandexcludecondition lists evaluated against the enriched event payload. Events that don't pass are dropped before batching, so filtered events never count against downstream ingest.includeis any-of,excludeis none-of, and both can be combined with the existingnamespace_filter. The condition vocabulary is shared with the trigger engine (equals,not_equals,contains,regex,gt/gte/lt/lte,exists,in_array) againstgjsonpaths. Invalid regexes or conditions without a comparator fail the connector at startup rather than silently letting everything through.
0.2.0 — 2026-05-12
Added
- OTel subscriber. Native OTLP exporter shipping logs and metrics over HTTP/protobuf or gRPC. Resource attributes
(
service.name,service.instance.id, plus user-supplied keys) are applied to every record; per-event log attributes are promoted from configurable gjson paths into the enriched event payload. Compatible with any OTel-compliant endpoint — Collector, vendor backend (Grafana Cloud, Honeycomb, New Relic, …), or the ClickHouse via OTel pipeline without the webhook hop. Log recordTimestampis OpenZiti's event time;ObservedTimestampis the connector's receive time. - OTel metrics, scoped to the
metricsnamespace. Only events emitted by OpenZiti's metrics subsystem are eligible for metric output — every other OpenZiti event is interval- or transaction-shaped and would produce incorrect rates if mapped to instruments. Each numeric leaf in a metrics event becomes a gauge named<metric_prefix><metric_name>[.<leaf_key>]; per-event attributes (source_id,metric_type, etc.) are promoted viaattribute_paths. Metric names are sanitized to the OTLP charset so REST-route timers like/edge/management/v1/…/:id.DELETEreach the backend.
Changed
- Renamed
webhooksubscriber →raw_http. The old name suggested webhook semantics; the subscriber is a raw HTTP/JSON POSTer with no callback model. The new name reflects what it actually does and avoids confusion with the alert webhooks in the trigger engine (which keep thewebhookname). Breaking config change. Migration: renamesubscribers.webhook→subscribers.raw_http. Field names are unchanged. Thetriggers.default_webhookand per-ruletriggers.rules[].webhookconfig blocks are unaffected — those are real webhooks.
0.1.2 — 2026-05-11
Added
- Splunk subscriber. New output that forwards enriched events to a Splunk HTTP Event Collector endpoint as gzip-compressed batches, with retry-with-backoff on transient failures.
- Splunk indexed-field promotion. Promote per-event JSON values into Splunk indexed fields without requiring a server-side parser change.
- Splunk indexer acknowledgement. Optional mode that confirms each batch reached the indexer before counting events as delivered.
Fixed
- Graceful shutdown.
SIGINT/SIGTERMnow drains buffered events through each subscriber's batch pipeline before exit, instead of occasionally crashing or silently dropping in-flight batches.
0.1.1 — 2026-05-04
Added
- Datadog subscriber. New output with independent logs and metrics channels, per-channel batching, gzip compression, and retry-with-backoff on transient failures.
- Datadog metric mappings. Configurable per-namespace rules to extract gauge, count, and rate metrics from event payloads.
0.1.0 — 2026-04-22
Initial tagged release.
Added
- Core pipeline. WebSocket source connecting to an OpenZiti controller event stream, in-memory enrichment cache for ID-to-name resolution, and a non-blocking pub-sub bus that fans events out to multiple subscribers.
- Subscribers shipped:
stdout,webhook,elasticsearch,s3,syslog. - HA controller support. Host rotation on failure, exponential-backoff reconnect, and dead-connection detection via heartbeat.
- Trigger engine. Rule-based alerting that fires webhooks when events match configured conditions.
- Live TUI. Throughput view with per-namespace pipeline counts and per-subscriber queue depth, delivered, dropped, and worker counts.
Packaging
- Debian packages (
amd64+arm64) with hardened systemd unit and dedicated system user. - Multi-arch Docker images.
- Standalone binaries for macOS, Linux, and Windows.