fluent-plugin-opentelemetry 0.5.2 → 0.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7caa8c736a332ab38da184793751d6760bc1d8bf59c996bffcbe324dd5da7ab5
-  data.tar.gz: d4c07bffd3ccdd29e8b151a134e5bbe77e1686d8e0ad9a84e5ecd432224d1dd1
+  metadata.gz: dad225b751029746a86f4bdeae0b9f415d0756c25d9c560e7606ac11c13ade0b
+  data.tar.gz: '091d4d6113b42822cc47e6cd386aa10e2044f9a146d401e437eefe21b11df10e'
 SHA512:
-  metadata.gz: 48d509ee79d59085508bd591c051d7ba8cc33efc3e0cb1d64e8ad04f28ed60444fdd4f322e65d4e41ffc84c3d0e7c7770bf7f3cfe1d1076df692ba5dfb8dddcc
-  data.tar.gz: 9c21c80065796cdadc5fb8aad7c4c1b810cff27a1581d5e83a21d4de920ff34f9318d52f39337c599da8148bbbb6f4f1ac6e365459373079d906cd6812397c77
+  metadata.gz: d5919a65f7d4adf3491c16cc3a098283bb69f7fd84a09e88730d15df7919c878838eee465d3315f5f762acd323f2a0983c2445f74b36384526ea1a1dc2e04f51
+  data.tar.gz: fe3517def463d5c8ae2c559df0e42438d518ae4d74f0ccfc6e900c570ca74b1cca2d1b31a97da33e79d566ba304884c5646f13a46869d3ea8147ba209143d1c9

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 ## [Unreleased]
 
+## [0.5.4] - 2026-09-04
+
+Fixes:
+
+- Apply <transport tls> ca_path to HTTP connections (#55)
+- Apply <transport tls> settings to gRPC connections (#54)
+- out_opentelemetry: skip invalid records instead of failing the chunk (#53)
+
+## [0.5.3] - 2026-06-25
+
+Fixes:
+
+- in_opentelemetry: enforce size limits on incoming payloads
+
 ## [0.5.2] - 2026-03-15
 
 Improvements:

data/README.md

@@ -1,5 +1,8 @@
 # fluent-plugin-opentelemetry
 
+[![Gem Version](https://badge.fury.io/rb/fluent-plugin-opentelemetry.svg)](https://badge.fury.io/rb/fluent-plugin-opentelemetry)
+[![Test](https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry/actions/workflows/test.yml/badge.svg)](https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry/actions/workflows/test.yml)
+
 [Fluentd](https://fluentd.org/) input/output plugin to forward [OpenTelemetry Protocol](https://github.com/open-telemetry/opentelemetry-proto) data.
 
 ## Installation
@@ -65,10 +68,12 @@ Example:
 
 This requires to receive data via HTTP/HTTPS.
 
-| parameter | type    | description            | default   |
-|-----------|---------|------------------------|-----------|
-| bind      | string  | The address to bind to | `0.0.0.0` |
-| port      | integer | The port to listen to  | `4318`    |
+| parameter                | type    | description                                                                                                               | default   |
+|--------------------------|---------|---------------------------------------------------------------------------------------------------------------------------|-----------|
+| bind                     | string  | The address to bind to                                                                                                    | `0.0.0.0` |
+| port                     | integer | The port to listen to                                                                                                     | `4318`    |
+| body_size_limit          | size    | The size limit of the POSTed element. This value should be larger than the 'chunk_limit_size' in out_opentelemetry plugin | `32M` (32MiB)     |
+| decompression_size_limit | size    | The size limit of the decompressed element                                                                                | `256M`  (256MiB)   |
 
 #### `<grpc>` section
 
@@ -87,6 +92,11 @@ It needs to install `grpc` gem manually to use this feature.
 
 Refer [Config: Transport Section](https://docs.fluentd.org/configuration/transport-section)
 
+When the `<grpc>` section is configured, `<transport tls>` applies to the gRPC listener as well. gRPC uses `ca_path`, `cert_path`, `private_key_path`, `private_key_passphrase` and `client_cert_auth`, and the other TLS parameters have no effect on the gRPC listener. `client_cert_auth` requires `ca_path`, because gRPC has no default trust store for client certificates.
+
+> [!WARNING]
+> This changes the behavior of an existing configuration that has both `<transport tls>` and `<grpc>`. The gRPC listener used to accept plaintext regardless of `<transport tls>`, and it now requires TLS. Plaintext OTLP/gRPC clients have to be switched to TLS.
+
 #### Example
 
 ```
@@ -144,6 +154,19 @@ To output the data, it requires to use output `opentelemetry` plugin.
 >
 > **PromQL Example:** `rate(fluentd_process_cpu_time_seconds_total[$__rate_interval])`
 
+> [!NOTE]
+> **Process Metrics (CPU / Memory)**
+>
+> Fluentd operates on a multi-process architecture consisting of a Supervisor process and one or more Worker processes.
+>
+> Because this plugin runs inside a specific worker process, the process-level metrics it collects (such as CPU time and memory usage) represent **only the footprint of that single worker process**, not the total resource consumption of the entire Fluentd instance.
+>
+> If you are using a multi-worker configuration (`<system> workers N </system>`), be aware that the actual total CPU and memory usage of Fluentd will be higher than what this plugin reports.
+>
+> For accurate, instance-wide resource monitoring, we strongly recommend using external OS-level monitoring tools rather than relying on application-internal metrics:
+> * Container Environments (Kubernetes/Docker): Use tools like `cAdvisor` or `kube-state-metrics`, etc.
+> * VM/Bare-metal Environments: Use `node_exporter` combined with `process-exporter`, etc.
+
 ### Output `opentelemetry` plugin
 
 To send data, this plugin requires `<http>` or `<grpc>` section.
@@ -189,9 +212,11 @@ It needs to install `grpc` gem manually to use this feature.
 
 | parameter              | type    | description                                    | default |
 |------------------------|---------|------------------------------------------------|---------|
+| ca_path                | string  | Specifies the path of CA Certificate file used to verify the server | `nil`   |
 | cert_path              | string  | Specifies the path of Certificate file         | `nil`   |
 | private_key_path       | string  | Specifies the path of Private Key file         | `nil`   |
 | private_key_passphrase | string  | Specifies the public CA private key passphrase | `nil`   |
+| insecure               | bool    | Skips the verification of the server certificate | `false` |
 
 | parameter   | type | description                                                 | available values               | default |
 |-------------|------|-------------------------------------------------------------|--------------------------------|---------|
@@ -200,6 +225,18 @@ It needs to install `grpc` gem manually to use this feature.
 
 Refer [Config: Transport Section](https://docs.fluentd.org/configuration/transport-section)
 
+The HTTP connection uses `ca_path`, `cert_path`, `private_key_path`, `private_key_passphrase`, `min_version`, `max_version` and `insecure`, and the other TLS parameters have no effect on it. `ca_path` is added to the default trusted CAs of the system instead of replacing them.
+
+Fluentd rejects a `<transport tls>` section that configures no certificate at all, so pair `ca_path` with `insecure true` to verify the server without presenting a client certificate. On the HTTP connection, `insecure true` skips the verification only when `ca_path` is omitted.
+
+> [!WARNING]
+> This changes the behavior of an existing configuration that has both `ca_path` and `insecure true`. The HTTP connection used to skip the verification, and it now verifies the server certificate and its hostname. Drop `ca_path` to keep the previous behavior.
+
+When the `<grpc>` section is configured, `<transport tls>` applies to the gRPC connection as well. gRPC uses `ca_path`, `cert_path`, `private_key_path` and `private_key_passphrase`, and the other TLS parameters have no effect on the gRPC connection. `insecure` does not weaken the gRPC connection: the server certificate is verified against `ca_path`, or against the default root certificates of gRPC when `ca_path` is omitted.
+
+> [!WARNING]
+> This changes the behavior of an existing configuration that has both `<transport tls>` and `<grpc>`. The gRPC connection used to be plaintext regardless of `<transport tls>`, and it now uses TLS, so the collector has to accept it.
+
 #### `<buffer>` section
 
 | parameter        | type    | description                                                     | default    |
@@ -231,4 +268,3 @@ Refer [Config: Buffer Section](https://docs.fluentd.org/configuration/buffer-sec
 * Copyright(c) 2025- Shizuo Fujita
 * License
   * Apache License, Version 2.0
-

data/TODO.md

@@ -8,10 +8,13 @@ Ref. https://github.com/open-telemetry/opentelemetry-proto/blob/main/docs/specif
   - [x] [MUST] Gzip compression, denoted by gzip.
 
 ### OTLP/gRPC Concurrent Requests
-- [ ] [SHOULD] The implementations that need to achieve high throughput SHOULD support concurrent Unary calls to achieve higher throughput.
+- [x] [SHOULD] The implementations that need to achieve high throughput SHOULD support concurrent Unary calls to achieve higher throughput.
+   * NOTE: Supported by `flush_thread_count` settings in `<buffer>`.
 - [ ] [SHOULD] The client SHOULD send new requests without waiting for the response to the earlier sent requests, essentially creating a pipeline of requests that are currently in flight that are not acknowledged.
-- [ ] [SHOULD] The number of concurrent requests SHOULD be configurable.
-- [ ] [SHOULD] The client implementation SHOULD expose an option to turn on and off the waiting during a shutdown.
+- [x] [SHOULD] The number of concurrent requests SHOULD be configurable.
+   * NOTE: Supported by `flush_thread_count` settings in `<buffer>`.
+- [x] [SHOULD] The client implementation SHOULD expose an option to turn on and off the waiting during a shutdown.
+   * NOTE: Supported by `flush_at_shutdown` settings in `<buffer>`.
 
 ### OTLP/gRPC Response
 - Full Success
@@ -30,7 +33,8 @@ Ref. https://github.com/open-telemetry/opentelemetry-proto/blob/main/docs/specif
   - [ ] [SHOULD] Retryable errors indicate that telemetry data processing failed, and the client SHOULD record the error and may retry exporting the same data.
   - [ ] [SHOULD] The client SHOULD maintain a counter of such dropped data.
   - [ ] [SHOULD] The client SHOULD interpret gRPC status codes as retryable or not-retryable according to the following table.
-  - [ ] [SHOULD] When retrying, the client SHOULD implement an exponential backoff strategy.
+  - [x] [SHOULD] When retrying, the client SHOULD implement an exponential backoff strategy.
+     * NOTE: Fluentd's retry mechanism has `retry_type: exponential_backoff` by default.
   - [ ] [SHOULD] The client SHOULD interpret RESOURCE_EXHAUSTED code as retryable only if the server signals that the recovery from resource exhaustion is possible.
 
 ### OTLP/gRPC Throttling
@@ -91,18 +95,21 @@ Ref. https://github.com/open-telemetry/opentelemetry-proto/blob/main/docs/specif
 - OTLP/HTTP Throttling
   - [ ] [SHOULD] If the server receives more requests than the client is allowed or the server is overloaded, the server SHOULD respond with HTTP 429 Too Many Requests or HTTP 503 Service Unavailable.
   - [ ] [SHOULD] The client SHOULD honour the waiting interval specified in the "Retry-After" header if it is present.
-  - [ ] [SHOULD] The "Retry-After" header is not present in the response, then the client SHOULD implement an exponential backoff strategy between retries.
+  - [x] [SHOULD] The "Retry-After" header is not present in the response, then the client SHOULD implement an exponential backoff strategy between retries.
+    * NOTE: Fluentd's retry mechanism has `retry_type: exponential_backoff` by default.
 - All Other Responses
   - [x] [SHOULD] If the server disconnects without returning a response, the client SHOULD retry and send the same request.
   - [x] [SHOULD] The client SHOULD implement an exponential backoff strategy between retries to avoid overwhelming the server.
 
 ### OTLP/HTTP Connection
-- [ ] [SHOULD] If the client cannot connect to the server, the client SHOULD retry the connection using an exponential backoff strategy between retries.
-- [ ] [SHOULD] The client SHOULD keep the connection alive between requests.
+- [x] [SHOULD] If the client cannot connect to the server, the client SHOULD retry the connection using an exponential backoff strategy between retries.
+  * NOTE: Fluentd's retry mechanism has `retry_type: exponential_backoff` by default.
+- [x] [SHOULD] The client SHOULD keep the connection alive between requests.
 - [ ] [SHOULD] Server implementations SHOULD accept OTLP/HTTP with binary-encoded Protobuf payload and OTLP/HTTP with JSON-encoded Protobuf payload requests on the same port and multiplex the requests to the corresponding payload decoder based on the "Content-Type" request header.
 
 ### OTLP/HTTP Concurrent Requests
-- [ ] [SHOULD] To achieve higher total throughput, the client MAY send requests using several parallel HTTP connections. In that case, the maximum number of parallel connections SHOULD be configurable.
+- [x] [SHOULD] To achieve higher total throughput, the client MAY send requests using several parallel HTTP connections. In that case, the maximum number of parallel connections SHOULD be configurable.
+  * NOTE: Supported by `flush_thread_count` settings in `<buffer>`.
 
 # Future Versions and Interoperability
 - [ ] [MUST] When possible, the interoperability MUST be ensured between all versions of OTLP that are not declared obsolete.

data/lib/fluent/plugin/in_opentelemetry.rb

@@ -2,6 +2,7 @@
 
 require "fluent/plugin/input"
 require "fluent/plugin/opentelemetry/constant"
+require "fluent/plugin/opentelemetry/grpc_tls"
 require "fluent/plugin/opentelemetry/http_input_handler"
 require "fluent/plugin_helper/http_server"
 require "fluent/plugin_helper/thread"
@@ -27,6 +28,11 @@ module Fluent::Plugin
       config_param :bind, :string, default: "0.0.0.0"
       desc "The port to listen to."
       config_param :port, :integer, default: 4318
+
+      desc "The size limit of the POSTed element. This value should be larger than the 'chunk_limit_size' in out_opentelemetry plugin."
+      config_param :body_size_limit, :size, default: 32 * 1024 * 1024
+      desc "The size limit of the decompressed element."
+      config_param :decompression_size_limit, :size, default: 256 * 1024 * 1024
     end
 
     config_section :grpc, required: false, multi: false, init: false, param_name: :grpc_config do
@@ -52,13 +58,15 @@ module Fluent::Plugin
       unless [@http_config, @grpc_config].any?
         raise Fluent::ConfigError, "Please configure either <http> or <grpc> section, or both."
       end
+
+      Opentelemetry::GrpcTLS.validate_server!(@transport_config) if @grpc_config
     end
 
     def start
       super
 
       if @http_config
-        http_handler = Opentelemetry::HttpInputHandler.new
+        http_handler = Opentelemetry::HttpInputHandler.new(@http_config, log)
         http_server_create_http_server(:in_opentelemetry_http_server, addr: @http_config.bind, port: @http_config.port, logger: log) do |serv|
           serv.post("/v1/logs") do |req|
             http_handler.logs(req) { |record| router.emit(tag_for(Opentelemetry::RECORD_TYPE_LOGS), Fluent::EventTime.now, { "type" => Opentelemetry::RECORD_TYPE_LOGS, "message" => record }) }
@@ -73,8 +81,8 @@ module Fluent::Plugin
       end
 
       if @grpc_config
+        @grpc_handler = Opentelemetry::GrpcInputHandler.new(@grpc_config, @transport_config, log)
         thread_create(:in_opentelemetry_grpc_server) do
-          @grpc_handler = Opentelemetry::GrpcInputHandler.new(@grpc_config, log)
           @grpc_handler.run(
             logs: lambda { |record|
               router.emit(tag_for(Opentelemetry::RECORD_TYPE_LOGS), Fluent::EventTime.now, { "type" => Opentelemetry::RECORD_TYPE_LOGS, "message" => record })

data/lib/fluent/plugin/opentelemetry/constant.rb

@@ -5,7 +5,7 @@ require "openssl"
 
 module Fluent::Plugin::Opentelemetry
   CONTENT_TYPE = "Content-Type"
-  CONTENT_TYPE_PAIN = "text/plain"
+  CONTENT_TYPE_PLAIN = "text/plain"
   CONTENT_TYPE_PROTOBUF = "application/x-protobuf"
   CONTENT_TYPE_JSON = "application/json"
 

data/lib/fluent/plugin/opentelemetry/grpc_input_handler.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "fluent/plugin/opentelemetry/grpc_tls"
 require "fluent/plugin/opentelemetry/response"
 require "opentelemetry/proto/collector/logs/v1/logs_service_services_pb"
 require "opentelemetry/proto/collector/metrics/v1/metrics_service_services_pb"
@@ -49,14 +50,15 @@ module Fluent::Plugin::Opentelemetry
       end
     end
 
-    def initialize(grpc_config, logger)
+    def initialize(grpc_config, transport_config, logger)
       @grpc_config = grpc_config
       @logger = logger
+      @credentials = Fluent::Plugin::Opentelemetry::GrpcTLS.server_credentials(transport_config)
     end
 
     def run(logs:, metrics:, traces:)
       @server = GRPC::RpcServer.new(interceptors: [ExceptionInterceptor.new])
-      @server.add_http2_port("#{@grpc_config.bind}:#{@grpc_config.port}", :this_port_is_insecure)
+      @server.add_http2_port("#{@grpc_config.bind}:#{@grpc_config.port}", @credentials)
 
       logs_handler = ServiceHandler::Logs.new
       logs_handler.callback = lambda { |request|

data/lib/fluent/plugin/opentelemetry/grpc_output_handler.rb

@@ -8,6 +8,7 @@ require "opentelemetry/proto/collector/trace/v1/trace_service_pb"
 require "opentelemetry/proto/collector/trace/v1/trace_service_services_pb"
 
 require "fluent/plugin/opentelemetry/constant"
+require "fluent/plugin/opentelemetry/grpc_tls"
 require "google/protobuf"
 
 class Fluent::Plugin::Opentelemetry::GrpcOutputHandler
@@ -56,10 +57,11 @@ class Fluent::Plugin::Opentelemetry::GrpcOutputHandler
     channel_args["grpc.keepalive_time_ms"] = grpc_config.keepalive_time * 1000
     channel_args["grpc.keepalive_timeout_ms"] = grpc_config.keepalive_timeout * 1000
     channel_args["grpc.keepalive_permit_without_calls"] = 1
+    credentials = Fluent::Plugin::Opentelemetry::GrpcTLS.channel_credentials(@transport_config)
     @services = {
-      Fluent::Plugin::Opentelemetry::RECORD_TYPE_LOGS => ServiceStub::Logs.new(@grpc_config.endpoint, :this_channel_is_insecure, channel_args: channel_args),
-      Fluent::Plugin::Opentelemetry::RECORD_TYPE_METRICS => ServiceStub::Metrics.new(@grpc_config.endpoint, :this_channel_is_insecure, channel_args: channel_args),
-      Fluent::Plugin::Opentelemetry::RECORD_TYPE_TRACES => ServiceStub::Traces.new(@grpc_config.endpoint, :this_channel_is_insecure, channel_args: channel_args)
+      Fluent::Plugin::Opentelemetry::RECORD_TYPE_LOGS => ServiceStub::Logs.new(@grpc_config.endpoint, credentials, channel_args: channel_args),
+      Fluent::Plugin::Opentelemetry::RECORD_TYPE_METRICS => ServiceStub::Metrics.new(@grpc_config.endpoint, credentials, channel_args: channel_args),
+      Fluent::Plugin::Opentelemetry::RECORD_TYPE_TRACES => ServiceStub::Traces.new(@grpc_config.endpoint, credentials, channel_args: channel_args)
     }
   end
 

data/lib/fluent/plugin/opentelemetry/grpc_tls.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "fluent/plugin/opentelemetry/constant"
+
+require "openssl"
+
+module Fluent::Plugin::Opentelemetry
+  module GrpcTLS
+    module_function
+
+    def validate_server!(transport_config)
+      return unless tls?(transport_config)
+
+      if transport_config.cert_path.nil? || transport_config.private_key_path.nil?
+        raise Fluent::ConfigError, "<transport tls> cert_path and private_key_path are required when <grpc> is used"
+      end
+
+      if transport_config.client_cert_auth && transport_config.ca_path.nil?
+        raise Fluent::ConfigError, "<transport tls> client_cert_auth requires ca_path when <grpc> is used"
+      end
+
+      [transport_config.ca_path, transport_config.cert_path, transport_config.private_key_path].compact.each do |path|
+        raise Fluent::ConfigError, "<transport tls> cannot read '#{path}'" unless File.readable?(path)
+      end
+    end
+
+    def channel_credentials(transport_config)
+      return :this_channel_is_insecure unless tls?(transport_config)
+
+      GRPC::Core::ChannelCredentials.new(
+        read_pem(transport_config.ca_path),
+        read_private_key(transport_config),
+        read_pem(transport_config.cert_path)
+      )
+    end
+
+    def server_credentials(transport_config)
+      return :this_port_is_insecure unless tls?(transport_config)
+
+      GRPC::Core::ServerCredentials.new(
+        read_pem(transport_config.ca_path),
+        [{ private_key: read_private_key(transport_config), cert_chain: read_pem(transport_config.cert_path) }],
+        transport_config.client_cert_auth
+      )
+    end
+
+    def tls?(transport_config)
+      transport_config.protocol == :tls
+    end
+
+    def read_pem(path)
+      return nil unless path
+
+      File.read(path)
+    rescue SystemCallError, IOError => e
+      raise Fluent::ConfigError, "<transport tls> failed to read '#{path}': #{e.message}"
+    end
+
+    def read_private_key(transport_config)
+      pem = read_pem(transport_config.private_key_path)
+      return nil unless pem
+
+      OpenSSL::PKey.read(pem, transport_config.private_key_passphrase.to_s).to_pem
+    rescue OpenSSL::PKey::PKeyError => e
+      raise Fluent::ConfigError,
+            "<transport tls> failed to load private_key_path '#{transport_config.private_key_path}': #{e.message}"
+    end
+
+    private_class_method :tls?, :read_pem, :read_private_key
+  end
+end

data/lib/fluent/plugin/opentelemetry/http_input_handler.rb

@@ -25,13 +25,26 @@ module Fluent::PluginHelper::HttpServer
           @request.body&.close
         end
       end
+
+      unless method_defined?(:body_stream)
+        def body_stream
+          @request.body
+        end
+      end
     end
   end
 end
 
 class Fluent::Plugin::Opentelemetry::HttpInputHandler
+  class SizeLimitError < StandardError; end
+
   using Fluent::PluginHelper::HttpServer::Extension
 
+  def initialize(http_config, logger)
+    @http_config = http_config
+    @logger = logger
+  end
+
   def logs(req, &block)
     common(req, Fluent::Plugin::Opentelemetry::Request::Logs, Fluent::Plugin::Opentelemetry::Response::Logs, &block)
   end
@@ -49,16 +62,40 @@ class Fluent::Plugin::Opentelemetry::HttpInputHandler
   def common(req, request_class, response_class)
     content_type = req.headers["content-type"]
     content_encoding = req.headers["content-encoding"]&.first
-    body = req.body
+
+    content_length = req.headers["content-length"]&.first&.to_i
+    if content_length && content_length >= @http_config.body_size_limit
+      @logger.warn { "Received too big content length: #{content_length}" }
+      return response_payload_too_large
+    end
+
+    begin
+      body = read_body(req, limit: @http_config.body_size_limit)
+    rescue SizeLimitError
+      @logger.warn { "Received payload exceeding body_size_limit" }
+      return response_payload_too_large
+    end
+
     return response_unsupported_media_type unless valid_content_type?(content_type)
     return response_bad_request(content_type) unless valid_content_encoding?(content_encoding)
 
-    body = Zlib::GzipReader.new(StringIO.new(body)).read if content_encoding == Fluent::Plugin::Opentelemetry::CONTENT_ENCODING_GZIP
+    if content_encoding == Fluent::Plugin::Opentelemetry::CONTENT_ENCODING_GZIP
+      begin
+        body = decompress(body, limit: @http_config.decompression_size_limit)
+      rescue SizeLimitError
+        @logger.warn { "Decompressed payload exceeding decompression_size_limit" }
+        return response_payload_too_large
+      rescue Zlib::Error => e
+        @logger.warn { "Failed to decompress gzip payload: #{e.message}" }
+        return response_bad_request(content_type)
+      end
+    end
 
     begin
       record = request_class.new(body).record
-    rescue Google::Protobuf::ParseError
+    rescue Google::Protobuf::ParseError => e
       # The format in request body does not comply with the OpenTelemetry protocol.
+      @logger.warn { "Failed to parse OpenTelemetry payload: #{e.message}" }
       return response_bad_request(content_type)
     end
 
@@ -70,6 +107,43 @@ class Fluent::Plugin::Opentelemetry::HttpInputHandler
     req.close
   end
 
+  def read_body(request, limit:)
+    body = +""
+    while (chunk = request.body_stream&.read)
+      body << chunk
+      if body.bytesize > limit
+        raise SizeLimitError, "Too large payload"
+      end
+    end
+    body
+  end
+
+  BYTES_TO_READ = 64 * 1024
+  private_constant :BYTES_TO_READ
+
+  def decompress(compressed_data, limit:)
+    io = StringIO.new(compressed_data)
+    out = +""
+    loop do
+      reader = Zlib::GzipReader.new(io)
+      while (chunk = reader.read(BYTES_TO_READ))
+        out << chunk
+        if out.bytesize > limit
+          raise SizeLimitError, "Decompressed data exceeds limit of #{limit} bytes"
+        end
+      end
+
+      unused = reader.unused
+      reader.finish
+      unless unused.nil?
+        adjust = unused.length
+        io.pos -= adjust
+      end
+      break if io.eof?
+    end
+    out
+  end
+
   def valid_content_type?(content_type)
     case content_type
     when Fluent::Plugin::Opentelemetry::CONTENT_TYPE_PROTOBUF, Fluent::Plugin::Opentelemetry::CONTENT_TYPE_JSON
@@ -90,7 +164,11 @@ class Fluent::Plugin::Opentelemetry::HttpInputHandler
   end
 
   def response_unsupported_media_type
-    response(415, Fluent::Plugin::Opentelemetry::CONTENT_TYPE_PAIN, "415 unsupported media type, supported: [application/json, application/x-protobuf]")
+    response(415, Fluent::Plugin::Opentelemetry::CONTENT_TYPE_PLAIN, "415 unsupported media type, supported: [application/json, application/x-protobuf]")
+  end
+
+  def response_payload_too_large
+    response(413, Fluent::Plugin::Opentelemetry::CONTENT_TYPE_PLAIN, "413 Payload Too Large")
   end
 
   def response_bad_request(content_type)

data/lib/fluent/plugin/opentelemetry/http_output_handler.rb

@@ -19,6 +19,7 @@ class Fluent::Plugin::Opentelemetry::HttpOutputHandler
       tls_settings[:client_cert] = @transport_config.cert_path
       tls_settings[:client_key] = @transport_config.private_key_path
       tls_settings[:client_key_pass] = @transport_config.private_key_passphrase
+      tls_settings[:ssl_ca_file] = @transport_config.ca_path unless @transport_config.ca_path.to_s.empty?
       tls_settings[:ssl_min_version] = Fluent::Plugin::Opentelemetry::TLS_VERSIONS_MAP[@transport_config.min_version]
       tls_settings[:ssl_max_version] = Fluent::Plugin::Opentelemetry::TLS_VERSIONS_MAP[@transport_config.max_version]
     end
@@ -29,7 +30,7 @@ class Fluent::Plugin::Opentelemetry::HttpOutputHandler
       connect_timeout: http_config.connect_timeout
     }
 
-    Excon.defaults[:ssl_verify_peer] = false if @transport_config.insecure
+    tls_settings[:ssl_verify_peer] = false if @transport_config.insecure && tls_settings[:ssl_ca_file].nil?
     @connections = {
       Fluent::Plugin::Opentelemetry::RECORD_TYPE_LOGS => Excon.new(http_logs_endpoint, proxy: @http_config.proxy, persistent: true, **tls_settings, **timeout_settings),
       Fluent::Plugin::Opentelemetry::RECORD_TYPE_METRICS => Excon.new(http_metrics_endpoint, proxy: @http_config.proxy, persistent: true, **tls_settings, **timeout_settings),

data/lib/fluent/plugin/opentelemetry/version.rb

@@ -3,7 +3,7 @@
 module Fluent
   module Plugin
     module Opentelemetry
-      VERSION = "0.5.2"
+      VERSION = "0.5.4"
     end
   end
 end

data/lib/fluent/plugin/out_opentelemetry.rb

@@ -90,7 +90,7 @@ module Fluent::Plugin
     end
 
     def write(chunk)
-      BatchProcessor.build_export_requests(chunk).each do |export_request|
+      BatchProcessor.build_export_requests(chunk, log).each do |export_request|
         if @grpc_handler
           @grpc_handler.export(export_request)
         else
@@ -106,22 +106,72 @@ module Fluent::Plugin
         Opentelemetry::RECORD_TYPE_TRACES => "resourceSpans"
       }.freeze
 
-      def self.build_export_requests(chunk)
+      class InvalidRecords
+        MAX_SAMPLE_BYTESIZE = 100
+        MAX_SAMPLES = 3
+        private_constant :MAX_SAMPLE_BYTESIZE, :MAX_SAMPLES
+
+        attr_reader :count
+
+        def initialize
+          @count = 0
+          @samples = []
+        end
+
+        def add(sample = nil)
+          @count += 1
+          return if sample.nil? || @samples.size >= MAX_SAMPLES
+
+          text = sample.byteslice(0, MAX_SAMPLE_BYTESIZE).scrub("")
+          @samples << text unless @samples.include?(text)
+        end
+
+        def to_s
+          @samples.empty? ? @count.to_s : "#{@count} (#{@samples.join(' | ')})"
+        end
+      end
+
+      def self.build_export_requests(chunk, logger)
         requests = {
           Opentelemetry::RECORD_TYPE_LOGS => {},
           Opentelemetry::RECORD_TYPE_METRICS => {},
           Opentelemetry::RECORD_TYPE_TRACES => {}
         }
+        invalid = Hash.new { |hash, key| hash[key] = InvalidRecords.new }
 
         chunk.each do |_, record| # rubocop:disable Style/HashEachMethods
           record_type = record["type"]
           resource_key = RESOURCE_KEY_MAP[record_type]
-          record["message"] = JSON.parse(record["message"])
-          resource_hash = record["message"][resource_key][0]["resource"].hash
+          unless resource_key
+            invalid["unknown type"].add(record_type.inspect)
+            next
+          end
+
+          begin
+            record["message"] = JSON.parse(record["message"])
+          rescue JSON::ParserError, TypeError => e
+            invalid["broken message"].add(e.message)
+            next
+          end
+
+          resources = record["message"][resource_key] if record["message"].is_a?(Hash)
+          unless resources.is_a?(Array) && resources.first.is_a?(Hash)
+            invalid["no #{resource_key}"].add
+            next
+          end
+
+          resource_hash = resources.first["resource"].hash
           if requests[record_type][resource_hash].nil?
             requests[record_type][resource_hash] = record
           else
-            requests[record_type][resource_hash]["message"][resource_key].concat(record["message"][resource_key])
+            requests[record_type][resource_hash]["message"][resource_key].concat(resources)
+          end
+        end
+
+        unless invalid.empty?
+          logger.warn do
+            details = invalid.map { |reason, records| "#{reason}=#{records}" }
+            "Skipped invalid records (total: #{invalid.values.sum(&:count)}): #{details.join(', ')}"
           end
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-opentelemetry
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.5.4
 platform: ruby
 authors:
 - Shizuo Fujita
@@ -112,6 +112,7 @@ files:
 - lib/fluent/plugin/opentelemetry/constant.rb
 - lib/fluent/plugin/opentelemetry/grpc_input_handler.rb
 - lib/fluent/plugin/opentelemetry/grpc_output_handler.rb
+- lib/fluent/plugin/opentelemetry/grpc_tls.rb
 - lib/fluent/plugin/opentelemetry/http_input_handler.rb
 - lib/fluent/plugin/opentelemetry/http_output_handler.rb
 - lib/fluent/plugin/opentelemetry/request.rb
@@ -138,6 +139,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry
   source_code_uri: https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry
+  changelog_uri: https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry/blob/main/CHANGELOG.md
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -153,7 +155,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.18
 specification_version: 4
 summary: Fluentd input/output plugin to forward OpenTelemetry Protocol data.
 test_files: []