KNOWLEDGE BASE

Release Notes v5.1.0

Fluent Bit is a Fast and Lightweight Telemetry Agent for Linux, BSD, macOS and Windows. We are proud to announce the availability of Fluent Bit v5.1.0.

For people upgrading from previous versions, please read the Upgrading Notes section of our documentation:

https://docs.fluentbit.io/manual/5.1/installation/upgrade_notes

Fluent Bit v5.1 expands the performance and operational foundations introduced in v5.0. This release adds multi-worker listener concurrency across the major network inputs, substantially accelerates batched OTLP and Forward ingestion, introduces native Google Cloud Storage and Event Tracing for Windows integrations, broadens hardware and host metrics, and strengthens secure operation with FIPS mode, certificate reloading, HTTPS proxy support, and DTLS.

The release contains 391 commits since v5.0, with improvements across the engine, networking stack, inputs, filters, outputs, packaging, bundled libraries, and test coverage.

What’s new ?

🔥 Multi-worker network ingestion

Fluent Bit v5.1 introduces a shared listener-worker runtime that lets busy inputs accept and decode traffic concurrently across multiple CPU cores while continuing to feed the same Fluent Bit pipeline.

• tcp, udp, forward, and TCP syslog inputs now accept a workers setting
• HTTP-based inputs use http_server.workers; this includes http, elasticsearch, splunk, opentelemetry, and prometheus_remote_write
• worker-to-engine handoff uses bounded ingress queues with overload handling, configurable event and byte limits, and queue-pressure metrics
• pause, resume, connection limits, TLS, HTTP/1.1, HTTP/2, and orderly shutdown are coordinated across workers
• the default remains one worker, preserving existing behavior unless concurrency is explicitly enabled

Release validation with four listener workers showed more than 2x end-to-end throughput for OTLP, TCP, and Syslog workloads. Packed Forward mode also gained frame-level batching, reaching up to 5.25x the v5.0 throughput in the release workload while using less CPU for the same record count. Actual scaling depends on protocol, processors, storage, output capacity, CPU allocation, and queue limits.

Faster OpenTelemetry ingestion

The OpenTelemetry path now uses bounded request arenas for realistic batched Protobuf payloads and carries known record counts through ingestion instead of rescanning encoded MessagePack. In production-style release builds, four-worker OTLP/HTTP Protobuf ingestion reached 3.6x the v5.0 throughput and improved CPU efficiency by roughly one third.

OTLP JSON handling also validates container and array value types more strictly, and HTTP protocol detection now handles split HTTP/2 prefaces and malformed HTTP/1 requests more reliably.

New cloud, Windows, and hardware integrations

• a new Google Cloud Storage output provides service-account authentication, persistent buffering, gzip compression, ordering controls, and configurable object-key formats
• a new Event Tracing for Windows input collects provider or kernel sessions, exposes loss metrics, and validates session and buffer settings
• the GPU Metrics input now supports NVIDIA GPUs through NVML, including MIG discovery and per-process metrics, alongside the existing AMD collector
• Windows Nano Server container images join the existing Server Core packaging, and Windows build and runtime coverage has expanded across the project

Core

• networking: add managed multi-worker listeners and bounded cross-thread ingestion for direct socket and HTTP-server inputs
• engine: add optional adaptive flush intervals that respond to pipeline pressure within configurable minimum and maximum bounds
• telemetry: add input-rate observation and optional per-input, per-tag log record counters with cardinality controls
• security: add security.fips_mode, startup and reload-time FIPS validation, and FIPS-safe behavior in the S3 and Azure Blob outputs
• TLS: reload OpenSSL certificate, key, and CA material when files change; preserve detailed I/O errors and avoid recycling connections after peer shutdown
• proxying: add HTTPS proxy URLs and independent tls.proxy.* settings for TLS-in-TLS connections without mixing proxy and destination trust configuration
• networking: add DTLS support to the shared transport stack and Syslog output
• configuration: accept nested maps in YAML service and input sections, ignore supported YAML annotations, and accept elasticsearch as an output plugin alias for es
• timestamps: preserve and emit 64-bit timestamps beyond 2038 across the log event encoder, decoder, OpenTelemetry parsing, and standard output
• HTTP server: fail startup when the management server cannot bind, improve malformed-request handling, and make input pause and resume behavior consistent
• packaging: add a generated package index and release workflow, improve Debian post-install service handling, and add Windows Nano Server images
• tests: expand integration, runtime, internal, fuzzing, Windows, TLS, worker lifecycle, queue-pressure, protocol, FIPS, cloud output, and plugin coverage

Libraries

• cfl: upgrade the bundled Fluent Bit common library to v1.0.1
• cmetrics: upgrade to v2.2.1
• Monkey: upgrade to v1.8.9 and link its bundled libevent statically on Windows

Plugins

Inputs

• Event Tracing for Windows
  • add a new event_tracing_windows input for provider and Windows kernel logger sessions
  • support process, thread, image-load, context-switch, TCP/IP, and disk I/O kernel flags, plus event-loss metrics
• GPU Metrics
  • collect NVIDIA device, MIG, and per-process metrics through NVML
  • use consistent include and exclude selectors across AMD and NVIDIA GPUs
• OpenTelemetry
  • add multi-worker deferred ingestion and reduce allocation and record-counting overhead for batched Protobuf logs
  • reject invalid JSON container types and improve timestamp validation
• Forward
  • add TCP and TLS listener workers and batch packed Forward frames into a single engine handoff
  • move connection processing to event coroutines and correct byte accounting when buffers contain multiple frames
• Shared downstream listener inputs
  • add listener workers for TCP, UDP, and TCP Syslog, including TLS and RFC 6587 framing where applicable
  • bring HTTP, Elasticsearch, Splunk, OpenTelemetry, and Prometheus Remote Write into the same managed downstream lifecycle, with bounded ingress queues, shared connection limits, pause and resume coordination, and retryable overload responses
• Kubernetes Events
  • bound watch connection lifetimes, finalize database statements correctly, and harden MessagePack field and timestamp parsing
• Node Exporter Metrics
  • add Linux timex and cross-platform power-supply collectors
  • add macOS filesystem metrics and Linux TcpExt and IpExt netstat counters, and enable filesystem metrics by default
• Tail
  • add a Windows UTF-8 path encoding mode and improve Windows glob handling
• Windows Event Log
  • optionally include an EventData map and retain records when individual event rendering encounters errors
• Process Exporter Metrics and Podman Metrics
  • expire stale process metrics, correct RSS reporting, and add per-container Podman disk I/O metrics
• Exec, Lib, Emitter, and Calyptia Fleet
  • terminate Exec child processes cleanly during hot reload, improve Lib input draining throughput, reject Emitter self-routing cycles, and resolve Fleet YAML include paths more reliably

Processors & Filters

• Kubernetes
  • harden pod-association setup and error paths against crashes and memory leaks
• Expect
  • validate every record in a batch instead of only the first record
• Throttle
  • improve teardown and cleanup behavior

Outputs

• Google Cloud Storage
  • add a new gcs output with service-account OAuth2, disk-backed buffering, gzip compression, custom object paths, ordering controls, and configurable storage limits
• Amazon S3
  • make Apache Arrow and Parquet first-class format choices and apply compatible compression codecs inside columnar files
  • require exact log_key matches and enforce FIPS-compatible request hashing
• File
  • add size-based file rotation, retention limits, and optional gzip compression for rotated files
• Kafka
  • resolve Avro schemas from a remote Confluent Schema Registry by subject and version, with basic or bearer-token authentication
• Elasticsearch
  • support upstream high-availability server pools
• Syslog
  • add DTLS transport and enable TLS automatically when mode is tls or dtls
• S3, Azure Blob, Google Cloud Storage, and shared outputs
  • strengthen upload guards, authentication cleanup, proxy TLS validation, and failure handling

Join us

We want to hear from you. Our community keeps growing, and you can be part of it:

• Github: http://github.com/fluent/fluent-bit
• Slack: CNCF Slack, channel #fluent-bit (https://communityinviter.com/apps/cloud-native/cncf)
• Twitter: @fluentbit