Skip to main content

Changelog

Each version corresponds to a release/<version> tag in the git repository. Versions track the standalone binary, Debian package, and Docker image artifacts.

0.4.0 — 2026-08-06​

Changed​

  • Concurrent HA controller streaming. The connector now opens a websocket to every host in controller.hosts at once instead of streaming from one and failing over, because cluster telemetry is distributed rather than mirrored: metrics and usage come from the controller each router is attached to, circuit from the controller that handled the circuit, and entityChange and entityCount from the raft leader.
  • List every controller node in controller.hosts when upgrading. A config naming a single node of an HA cluster only ever received that node's share of events, so expect previously-missing events to start flowing downstream once every node is listed; single-controller deployments are unaffected.

0.3.0 — 2026-07-24​

Added​

  • Beats/Lumberjack input. New optional inputs.beats TCP listener so filebeat or any Beat can ship directly to the connector via output.logstash, with the Ziti controller source now optional so the connector can run Beats-only.
  • Field-based Elasticsearch index routing. The elasticsearch subscriber's optional index_field/index_allowlist route third-party documents to their own indices while native Ziti controller telemetry always uses the default ziti.<namespace> scheme.

Fixed​

  • entityCount events are no longer rejected by Elasticsearch. The subscriber de-dots the counts map keys (services.edge → services_edge) before indexing, avoiding the scalar-vs-object mapping collision that rejected every entityCount bulk write with a 400.

0.2.3 — 2026-06-17​

Fixed​

  • Elasticsearch index names are now forced lowercase. OpenZiti emits camelCase namespaces (e.g. edge.apiSession), which produced mixed-case data stream names like ziti.apiSession. Elasticsearch rejects these with illegal_argument_exception: data_stream [...] must be lowercase (HTTP 400), and the affected events were silently dropped (logged only as a warning). The full index name — prefix and namespace suffix — is now lowercased before indexing.

0.2.2 — 2026-05-20​

Fixed​

  • Heartbeat no longer force-reconnects idle-but-healthy websockets. The staleness check tracked only event reception, so a successful keepalive ping did not reset the clock. On a quiet controller (few subscriptions, low fabric activity) the connection was torn down and re-established every ~30s in a loop. A successful pong now updates the staleness timestamp, so the connection stays up indefinitely as long as keepalives succeed; reconnect still triggers if the ping itself fails or times out.

0.2.1 — 2026-05-19​

Added​

  • Per-subscriber include/exclude filtering. Cost-sensitive sinks (datadog.logs, splunk, otel.logs, elasticsearch, s3, raw_http) now accept optional include and exclude condition lists evaluated against the enriched event payload. Events that don't pass are dropped before batching, so filtered events never count against downstream ingest. include is any-of, exclude is none-of, and both can be combined with the existing namespace_filter. The condition vocabulary is shared with the trigger engine (equals, not_equals, contains, regex, gt/gte/lt/lte, exists, in_array) against gjson paths. Invalid regexes or conditions without a comparator fail the connector at startup rather than silently letting everything through.

0.2.0 — 2026-05-12​

Added​

  • OTel subscriber. Native OTLP exporter shipping logs and metrics over HTTP/protobuf or gRPC. Resource attributes (service.name, service.instance.id, plus user-supplied keys) are applied to every record; per-event log attributes are promoted from configurable gjson paths into the enriched event payload. Compatible with any OTel-compliant endpoint — Collector, vendor backend (Grafana Cloud, Honeycomb, New Relic, …), or the ClickHouse via OTel pipeline without the webhook hop. Log record Timestamp is OpenZiti's event time; ObservedTimestamp is the connector's receive time.
  • OTel metrics, scoped to the metrics namespace. Only events emitted by OpenZiti's metrics subsystem are eligible for metric output — every other OpenZiti event is interval- or transaction-shaped and would produce incorrect rates if mapped to instruments. Each numeric leaf in a metrics event becomes a gauge named <metric_prefix><metric_name>[.<leaf_key>]; per-event attributes (source_id, metric_type, etc.) are promoted via attribute_paths. Metric names are sanitized to the OTLP charset so REST-route timers like /edge/management/v1/…/:id.DELETE reach the backend.

Changed​

  • Renamed webhook subscriber → raw_http. The old name suggested webhook semantics; the subscriber is a raw HTTP/JSON POSTer with no callback model. The new name reflects what it actually does and avoids confusion with the alert webhooks in the trigger engine (which keep the webhook name). Breaking config change. Migration: rename subscribers.webhook → subscribers.raw_http. Field names are unchanged. The triggers.default_webhook and per-rule triggers.rules[].webhook config blocks are unaffected — those are real webhooks.

0.1.2 — 2026-05-11​

Added​

  • Splunk subscriber. New output that forwards enriched events to a Splunk HTTP Event Collector endpoint as gzip-compressed batches, with retry-with-backoff on transient failures.
  • Splunk indexed-field promotion. Promote per-event JSON values into Splunk indexed fields without requiring a server-side parser change.
  • Splunk indexer acknowledgement. Optional mode that confirms each batch reached the indexer before counting events as delivered.

Fixed​

  • Graceful shutdown. SIGINT/SIGTERM now drains buffered events through each subscriber's batch pipeline before exit, instead of occasionally crashing or silently dropping in-flight batches.

0.1.1 — 2026-05-04​

Added​

  • Datadog subscriber. New output with independent logs and metrics channels, per-channel batching, gzip compression, and retry-with-backoff on transient failures.
  • Datadog metric mappings. Configurable per-namespace rules to extract gauge, count, and rate metrics from event payloads.

0.1.0 — 2026-04-22​

Initial tagged release.

Added​

  • Core pipeline. WebSocket source connecting to an OpenZiti controller event stream, in-memory enrichment cache for ID-to-name resolution, and a non-blocking pub-sub bus that fans events out to multiple subscribers.
  • Subscribers shipped: stdout, webhook, elasticsearch, s3, syslog.
  • HA controller support. Host rotation on failure, exponential-backoff reconnect, and dead-connection detection via heartbeat.
  • Trigger engine. Rule-based alerting that fires webhooks when events match configured conditions.
  • Live TUI. Throughput view with per-namespace pipeline counts and per-subscriber queue depth, delivered, dropped, and worker counts.

Packaging​

  • Debian packages (amd64 + arm64) with hardened systemd unit and dedicated system user.
  • Multi-arch Docker images.
  • Standalone binaries for macOS, Linux, and Windows.