abyo-software/ferro-stash

FerroStash is a data pipeline engine written in Rust that reads existing Logstash configuration files without changes and without a Java Virtual Machine. Logstash is a widely used tool for collecting, transforming, and routing log data and events, but it runs on the JVM and typically uses around 1 GB of memory at idle and takes many seconds to start. FerroStash reads the same pipeline.conf format and produces the same output events, but compiles to a single static binary of about 14 MB that starts in under a second and holds tens of megabytes of memory instead of hundreds. The pipeline model follows the same input, filter, and output pattern as Logstash. Supported inputs include file, TCP, HTTP, Syslog, Kafka, Beats, and Redis. Filters include grok, mutate, JSON, key-value parsing, dissect, and date. Outputs cover Elasticsearch, Kafka, S3, HTTP, file, Datadog, and more. If your existing pipeline uses Ruby filter blocks, FerroStash can run those using an embedded Ruby interpreter called mruby, so you can migrate without rewriting custom logic. There is also a native script filter using a subset of the Painless scripting language, which the README benchmarks at roughly 3.6 times the throughput of Logstash's Ruby path. The project includes benchmarks run against Logstash 9.4.2 on an AWS instance, showing 1.5 to 3.2 times higher throughput depending on the filter, 8 to 13 times lower memory use, and a cold start of about 10 milliseconds compared to 7 to 30 seconds for the JVM. The README is careful to label these as single-environment numbers, not universal guarantees. Output compatibility is verified field-for-field against Logstash 9.4.2 across 24 test fixtures. This is a first stable release from a single developer with no public production deployments reported yet. The README recommends running FerroStash alongside your current pipeline and comparing outputs before trusting it with important data. The test suite includes over 1,400 tests. An AWS Marketplace listing provides a pre-built AMI and a Kubernetes container billed through your AWS account. The open-source build under Apache 2.0 is the full engine. The full README is longer than what was shown.