fix(logstash source): never emit partial ACKs#25700
Open
bruceg wants to merge 2 commits into
Open
Conversation
A WindowSize frame that arrives before the current window has received all its advertised events now fails as a fatal decode error, closing the connection. While this is allowed by the official protocol specification, real clients (go-lumber, beats) always send exactly window_size events per window. More importantly, the reference go-lumber server treats a mid-window WindowSize as a protocol error. Matching actual implementations is more important than following the spec.
Change the ACK generation algorithm to only ever ack on completed windows. While partial ACKs are permitted by the official protocol spec and cause no problems for the `go-lumber` client in Beats, it appears to confuse proxies that assume there will only be one ACK per window, causing errors on subsequent batches. Relies on the premature-WindowSize rejection from the previous commit: a window can never be closed early, so every window the acker sees is either complete or a genuine trailing tail still being received. authors: bruceg
262601e to
b20a3f0
Compare
graphcareful
approved these changes
Jun 30, 2026
pront
approved these changes
Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Change the ACK generation algorithm to only ever ACK on completed windows. While partial ACKs are permitted by the official protocol spec and cause no problems for the
go-lumberclient in Beats, it appears to confuse proxies that assume there will only be one ACK per window, causing errors on subsequent batches.This requires a separate change to prevent ACKing a WindowSize frame that arrives before the current window has received all its advertised events and instead fail it as a fatal decode error, closing the connection. Again, this is allowed by the official protocol specification, real clients (go-lumber, beats) always send exactly window_size events per window. More importantly, the reference go-lumber server treats a mid-window WindowSize as a protocol error. Matching actual implementations is more important than following the spec.
Note that the two changes are in separate commits in order to facilitate review.
Vector configuration
Tested with both a
filebeatclient sending directly to Vector with a combination ofdelayprocessors and theblackholesink, as well as a production pipeline with live multiplexed connections.How did you test this PR?
As above, with the new conditions encoded in unit tests.
Change Type
Is this a breaking change?
Does this PR include user facing changes?
no-changeloglabel to this PR.References
Related: #23346 #25531 #25655 #25664
Notes
@vectordotdev/vectorto reach out to us regarding this PR.pre-pushhook, please see this template.make fmtmake check-clippy(if there are failures it's possible some of them can be fixed withmake clippy-fix)make testgit merge origin masterandgit push.Cargo.lock), pleaserun
make build-licensesto regenerate the license inventory and commit the changes (if any). More details on the dd-rust-license-tool.