FerroStash - Rust-native, Logstash-compatible log and event pipeline

FerroStash is a Rust-native, Logstash-compatible log and event pipeline. It ingests, transforms, and routes events through the same input -> filter -> output model as Logstash, parsing the Logstash pipeline.conf DSL (and an equivalent YAML form) natively - without a JVM and without a separate agent runtime. Where a Logstash pipeline commonly holds about a gigabyte of JVM heap and takes tens of seconds to start, FerroStash runs as a single static binary (about 14 MB) that starts in milliseconds and holds tens of MB of RAM, so you can pack far more shippers per host. What FerroStash does today (v1.0 line): it implements the production-common subset of the Logstash 9.x plugin set - about 88 percent of the bundled plugins (98 of 111), weighted toward the parsing and filtering hot path. Inputs include beats, file, tcp, udp, http, http_poller, syslog, kafka, redis, s3, sqs, jdbc, elasticsearch, cloudwatch, rabbitmq, and the dead-letter-queue. Filters include grok, dissect, kv, json, mutate, date, geoip, dns, csv, xml, useragent, cidr, fingerprint, translate, aggregate, throttle, plus a native Painless-style script filter. Outputs include elasticsearch / opensearch, kafka, s3, http, tcp, udp, file, redis, sqs, sns, cloudwatch, email, and datadog. Codecs include json, json_lines, multiline, cef, netflow, avro, msgpack, and protobuf. Reliability: an optional on-disk persistent queue with full at-least-once delivery (read/ack cursor separation, checkpoint-after-output-ack) and a dead-letter queue, with opt-in fsync for power-loss durability. A built-in monitoring API exposes node and pipeline stats. Engineering posture (verifiable): unsafe_code is denied workspace-wide (with narrow, audited exceptions for the optional mruby FFI and the script-filter JIT), clippy is clean at -D warnings with unwrap() denied in production code, an SPDX header is on every source file, a cargo deny supply-chain gate runs in CI, and the test suite runs 1,400+ tests with output verified against Logstash 9.4.2 expected fields across 24 parity fixtures. Compatibility scope: FerroStash is Logstash config / pipeline compatible across the covered plugin set. It is not a 100 percent drop-in - a covered plugin may implement a subset of that plugin's options, and a config that uses an unsupported plugin fails fast at load with a clear error rather than silently dropping events. The remaining gaps are mostly enterprise / niche connectors (for example jms, azure_event_hubs, snmp, lumberjack, webhdfs). The supported topology is single-node, and the optional ruby filter (Artichoke/mruby) is excluded from the default build. This Marketplace product is a hardened, security-scanned distribution at a pinned, SemVer-stable release version. The AMI is metered automatically by AWS per running instance-hour - there is no metering code in the product.