Release history

This page tracks releases that are relevant to the ElasticSearch / OpenSearch integration. Most Collectord changes are common to all products - for the full Collectord changelog, see the Monitoring Kubernetes Release history.

26.10.1 - 2026-10-26

Supports collectorforkubernetes version 26.10.x and below.

Collectord updates:

• One DaemonSet instead of two; the Helm charts’ -master DaemonSet is gone
• The Helm charts (oci://registry.outcold.solutions/outcoldsolutions/charts/collectord-elasticsearch and collectord-opensearch) and the manifests pull Collectord’s image from registry.outcold.solutions; where egress is filtered, allow it, ghcr.io and pkg-containers.githubusercontent.com. Docker Hub keeps the same images and charts: set collectord.image.repository: docker.io/outcoldsolutions/collectorforkubernetes, or the manifests’ image: lines, to pull from there
• The Helm charts take collectord.image.digest, empty by default: set it to the image’s sha256: digest to pin the image by digest (the FIPS image has a digest of its own)
• The manifests read the API server’s audit logs, as the Helm charts do
• Collectord runs under the built-in system-node-critical and system-cluster-critical priority classes, so the kubelet does not evict it
• The ClusterRole grants nothing on Secrets, and the addon no longer runs privileged
• The OpenSearch manifest reads opensearch.collectord.io/ annotations instead of elasticsearch.collectord.io/
• The charts bind Collectord’s HTTP server to 127.0.0.1:11891 (ElasticSearch) and 127.0.0.1:11892 (OpenSearch)
• New, off by default: repeated log lines go out as one counted event, and storms of alike lines fold into one summary a minute
• New, off by default: a report of each stream’s heaviest log patterns
• A bulk request rejected as too large (413) is split and resent
• Kubernetes objects are re-sent every 45 minutes instead of every 10 (refresh)
• A watch’s whitelist.* and blacklist.* now apply to Nodes, Namespaces and cluster-scoped custom resources
• The files rsyslog writes from the journal (/var/log/syslog, messages, auth.log and the like) are no longer read: the journal carries the same lines ([input.files::syslog] ships off); other /var/log/*.log files still are
• Journal entries carry their systemd unit and command name (systemd.unit, process.name)
• New [input.script::<name>] scripted inputs: run your own executable and send what it prints
• SIGHUP reloads the configuration instead of stopping Collectord
• New nodeSelector on host-log inputs, which keeps the API server audit-log input on the control-plane nodes
• Updated Go runtime to 1.27.3
• Bug fix: an index set in an override was ignored; it now applies, so check it before upgrading
• Bug fix: a host URL lost its path on bulk requests, and its user name and password were not sent
• Bug fix: Collectord restarted when ElasticSearch or OpenSearch refused its startup requests
• Bug fix: container logs could lose lines after restarts, rotations and pod deletions
• Bug fix: host logs could skip journal entries, and RFC 3339 /var/log/syslog lines were not extracted
• Bug fix: on busy clusters watches were dropped and re-listed every few minutes
• Bug fix: with several hosts, restarting the endpoints one by one could gather most Collectord instances on one of them; hostSelection now defaults to random

26.04.5 - 2026-09-28

Supports collectorforkubernetes version 26.04.x and below.

Collectord updates:

• Updated Go runtime to 1.26.8
• Updated SQLite library to 3.53.4
• DNS configuration and a health snapshot are now included in the diagnostic bundle
• Collectord verify command now checks DNS resolution for each output and reports the license grace period
• Bug fix: Proxy credentials (proxyBasicAuth) are now applied to the Elasticsearch output and sent only to the proxy
• Bug fix: In some environments, an incomplete bulk response (for example, an error page from a proxy) can crash Collectord
• Bug fix: A small batch for a quiet data stream can wait longer than the configured frequency
• Bug fix: When events is not set, each event can be sent as a separate bulk request
• Bug fix: The forwarding lag metric can report values from earlier batches
• Bug fix: In some configurations, a field whose name ends in .labels can crash Collectord
• Bug fix: A data stream that Elasticsearch accepts slowly can delay forwarding to other data streams
• Bug fix: Collectord can crash in some configurations (logs-timestampsetmonth without logs-timestampsetday, empty log lines, a replace template function with one argument)
• Bug fix: Field extraction with an optional message group can drop events in some cases
• Bug fix: The Prometheus endpoint (/metrics/prometheus) now reports the content type expected by Prometheus 3

26.04.1 - 2026-04-27

Supports collectorforkubernetes version 26.04.x and below.

Collectord updates:

• Updated Go runtime to 1.26.2
• Updated SQLite library to 3.53
• FIPS-compliant image
• Improved on-volume database for PVC volumes, preventing database corruption
• Collectord describe command now shows the source of each annotation ([pod], [namespace], [configuration:<name>])
• Many stability and performance fixes - see the Monitoring Kubernetes 26.04.1 entry for the full bullet list

25.10.x - 2025-10-27

Versioning scheme changed from semver (5.X) to YY.MM. See Monitoring Kubernetes 25.10.2 for Collectord changes.

Older releases

For Collectord changes prior to 25.10, refer to the Monitoring Kubernetes Release history. The agent binary is shared across products, and per-product differences are limited to the output configuration ([output.elasticsearch] here vs. [output.splunk] there).