Skip to content

fix(logstash source): never emit partial ACKs#25700

Open
bruceg wants to merge 2 commits into
masterfrom
bruceg/logstash-partial-window-protocol-error
Open

fix(logstash source): never emit partial ACKs#25700
bruceg wants to merge 2 commits into
masterfrom
bruceg/logstash-partial-window-protocol-error

Conversation

@bruceg

@bruceg bruceg commented Jun 29, 2026

Copy link
Copy Markdown
Member

Summary

Change the ACK generation algorithm to only ever ACK on completed windows. While partial ACKs are permitted by the official protocol spec and cause no problems for the go-lumber client in Beats, it appears to confuse proxies that assume there will only be one ACK per window, causing errors on subsequent batches.

This requires a separate change to prevent ACKing a WindowSize frame that arrives before the current window has received all its advertised events and instead fail it as a fatal decode error, closing the connection. Again, this is allowed by the official protocol specification, real clients (go-lumber, beats) always send exactly window_size events per window. More importantly, the reference go-lumber server treats a mid-window WindowSize as a protocol error. Matching actual implementations is more important than following the spec.

Note that the two changes are in separate commits in order to facilitate review.

Vector configuration

Tested with both a filebeat client sending directly to Vector with a combination of delay processors and the blackhole sink, as well as a production pipeline with live multiplexed connections.

How did you test this PR?

As above, with the new conditions encoded in unit tests.

Change Type

  • Bug fix
  • New feature
  • Dependencies
  • Non-functional (chore, refactoring, docs)
  • Performance

Is this a breaking change?

  • Yes
  • No

Does this PR include user facing changes?

  • Yes. Please add a changelog fragment based on our guidelines.
  • No. A maintainer will apply the no-changelog label to this PR.

References

Related: #23346 #25531 #25655 #25664

Notes

  • Please read our Vector contributor resources.
  • Do not hesitate to use @vectordotdev/vector to reach out to us regarding this PR.
  • Some CI checks run only after we manually approve them.
    • We recommend adding a pre-push hook, please see this template.
    • Alternatively, we recommend running the following locally before pushing to the remote branch:
      • make fmt
      • make check-clippy (if there are failures it's possible some of them can be fixed with make clippy-fix)
      • make test
  • After a review is requested, please avoid force pushes to help us review incrementally.
    • Feel free to push as many commits as you want. They will be squashed into one before merging.
    • For example, you can run git merge origin master and git push.
  • If this PR introduces changes Vector dependencies (modifies Cargo.lock), please
    run make build-licenses to regenerate the license inventory and commit the changes (if any). More details on the dd-rust-license-tool.

A WindowSize frame that arrives before the current window has received all its
advertised events now fails as a fatal decode error, closing the connection.
While this is allowed by the official protocol specification, real clients
(go-lumber, beats) always send exactly window_size events per window. More
importantly, the reference go-lumber server treats a mid-window WindowSize as a
protocol error.  Matching actual implementations is more important than
following the spec.
@bruceg bruceg requested a review from a team as a code owner June 29, 2026 16:54
@github-actions github-actions Bot added the domain: sources Anything related to the Vector's sources label Jun 29, 2026
@bruceg bruceg added the source: logstash Anything `logstash` source related label Jun 29, 2026
@bruceg bruceg requested a review from emilychendd June 29, 2026 17:06
Change the ACK generation algorithm to only ever ack on completed windows.
While partial ACKs are permitted by the official protocol spec and cause no
problems for the `go-lumber` client in Beats, it appears to confuse proxies that
assume there will only be one ACK per window, causing errors on subsequent
batches.

Relies on the premature-WindowSize rejection from the previous commit: a
window can never be closed early, so every window the acker sees is either
complete or a genuine trailing tail still being received.

authors: bruceg
@bruceg bruceg force-pushed the bruceg/logstash-partial-window-protocol-error branch from 262601e to b20a3f0 Compare June 29, 2026 18:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

domain: sources Anything related to the Vector's sources source: logstash Anything `logstash` source related

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants