AWS for Fluent Bit 2.28.4

2.28.4

This release includes:

• Fluent Bit 1.9.9
• Amazon CloudWatch Logs for Fluent Bit 1.9.1
• Amazon Kinesis Streams for Fluent Bit 1.10.1
• Amazon Kinesis Firehose for Fluent Bit 1.7.1

Important Note:

• Two security vulnerabilities were found in amazonlinux which we use as our base image- ALAS-40674 and ALAS-32207. This new image will be based on an updated version of amazonlinux that resolves this CVE.

Compared to 2.28.3 this release adds the following feature that we are working on getting accepted upstream:

• enhancement - Separate AWS User Agents for windows and linux fluentbit:6325

---

We’ve run the new released image in our ECS load testing framework and here is the result. This testing result provides benchmarks of aws-for-fluent-bit under different input load. Learn more about the load test.

plugin	source		20 MB/s	25 MB/s	30 MB/s
kinesis_firehose	stdstream	Log Loss	✅	✅	✅
		Log Duplication	✅	0%(5490)	✅
kinesis_firehose	tcp	Log Loss	✅	✅	0%(17696)
		Log Duplication	✅	✅	0%(21306)
kinesis_streams	stdstream	Log Loss	✅	✅	✅
		Log Duplication	✅	0%(53500)	0%(1000)
kinesis_streams	tcp	Log Loss	✅	✅	✅
		Log Duplication	✅	✅	✅
cloudwatch_logs	stdstream	Log Loss	16%(99000)	28%(339777)	25%(458092)
		Log Duplication	✅	✅	✅
cloudwatch_logs	tcp	Log Loss	14%(84144)	18%(222962)	43%(779277)
		Log Duplication	✅	✅	✅
s3	stdstream	Log Loss	✅	✅	✅
		Log Duplication	✅	✅	✅
s3	tcp	Log Loss	✅	✅	✅
		Log Duplication	✅	✅	✅

Note:

• The green check ✅ in the table means no log loss or no log duplication.
• Number in parentheses means the number of records out of total records. For example, 0%(1064/1.8M) under 30Mb/s throughput means 1064 duplicate records out of 18M input records by which log duplication percentage is 0%.
• For CloudWatch output, the only safe throughput where we consistently don't see log loss is 1 MB/s. At 2 Mb/s and beyond, we occasionally see some log loss and throttling.
• Log loss is the percentage of data lost and log duplication is the percentage of duplicate logs received at the destination. Your results may differ because they can be influenced by many factors like different configs and environment settings. Log duplication is exclusively caused by partially succeeded batches that were retried, which means it is random.