FerroStash Container - Rust-native Logstash-compatible log pipeline

FerroStash is a Rust-native, Logstash-compatible log and event pipeline, packaged here as a container for Amazon EKS and delivered by a Helm chart. It ingests, transforms, and routes events through the same input -> filter -> output model as Logstash, parsing the Logstash pipeline.conf DSL (and an equivalent YAML form) natively - without a JVM and without a separate agent runtime. Where a Logstash pipeline commonly holds about a gigabyte of JVM heap and takes tens of seconds to start, FerroStash runs as a single static binary (about 14 MB) that starts in milliseconds and holds tens of MB of RAM, so you can pack far more shippers per node. What FerroStash does today (v1.0 line): it implements the production-common subset of the Logstash 9.x plugin set - about 88 percent of the bundled plugins (98 of 111), weighted toward the parsing and filtering hot path. Inputs include beats, file, tcp, udp, http, http_poller, syslog, kafka, redis, s3, sqs, jdbc, elasticsearch, cloudwatch, rabbitmq, and the dead-letter-queue. Filters include grok, dissect, kv, json, mutate, date, geoip, dns, csv, xml, useragent, cidr, fingerprint, translate, aggregate, throttle, and ruby, plus a native Painless-style script filter. Outputs include elasticsearch / opensearch, kafka, s3, http, tcp, udp, file, redis, sqs, sns, cloudwatch, email, and datadog. Codecs include json, json_lines, multiline, cef, netflow, avro, msgpack, and protobuf. Reliability: an optional on-disk persistent queue with full at-least-once delivery (read/ack cursor separation, checkpoint-after-output-ack) and a dead-letter queue, with opt-in fsync for power-loss durability. A built-in monitoring API exposes node and pipeline stats. Deployment and billing: the chart deploys a single-node pipeline; configure it via the chart pipelineConf value (rendered into a ConfigMap). The container is metered by AWS per running pod-hour - it calls RegisterUsage once at startup as an entitlement check, so the pod needs AWS credentials (IRSA / Pod Identity) with aws-marketplace:RegisterUsage and the product code wired in by the chart. Engineering posture (verifiable): unsafe_code is denied workspace-wide (with narrow, audited exceptions for the optional mruby FFI and the script-filter JIT), clippy is clean at -D warnings with unwrap() denied in production code, a cargo deny supply-chain gate runs in CI, and the test suite runs 1,400+ tests with output verified byte-for-byte against Logstash 9.4.2 across 24 parity fixtures. Honest scope (read before you buy): FerroStash is Logstash config / pipeline compatible, NOT a byte-identical 100 percent drop-in - coverage is plugin-level (about 88 percent of bundled plugins), and a covered plugin may implement only a subset of that plugin's options; a config that uses a missing plugin fails fast at load with a clear error rather than silently dropping events. The remaining gaps are mostly enterprise / niche connectors (for example jms, azure_event_hubs, snmp, lumberjack, webhdfs). This is a single-developer project with a SemVer-stable surface but NO public production deployments yet - run it beside your existing pipeline before trusting it with irreplaceable data. The supported deployment topology is single-node. The optional ruby filter (Artichoke/mruby) is excluded from this container build. This listing sells a hardened, scanned, supported distribution built from the Apache-2.0 source at a pinned release version (a standard open-core commercial model); the code itself stays Apache-2.0 and the listing does not relicense it.