-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Description
Bug Report
Describe the bug
For IPv6 addresses, you can't just tack a colon and a port number at the end of an IPv6 literal and call it a day. Because if you want to represent, for example, the IPv6 address 2001:db8::1 and port 80, you can't just write "2001:db8::1:80", because that makes the :80 part look like it's part of the IPv6 address, causing ambiguity in parsing.
Unfortunately, when using the syslog input plugin, this is exactly what happens in an informational log message on startup, as per this example, when binding to ::
[2026/03/15 08:59:37.712] [ info] [in_syslog] UDP server binding :::5140
To Reproduce
Run fluent-bit with this config:
[SERVICE]
flush 1
daemon Off
log_level info
parsers_file ../conf/parsers.conf
[INPUT]
name syslog
tag syslog
listen ::
mode udp
parser syslog-rfc5424
source_address_key source
[OUTPUT]
name stdout
match *Observe this log message at startup:
[2026/03/15 08:59:37.712] [ info] [in_syslog] UDP server binding :::5140
Expected behavior
The log message should not represent IPv6 addreses and ports in an ambigious way.
Two possible alternative options:
[2026/03/15 08:59:37.712] [ info] [in_syslog] UDP server binding :: port 5140
[2026/03/15 08:59:37.712] [ info] [in_syslog] UDP server binding [::]:5140
I think the first one is easier, and is a simple template string adjustment. The second one requires a special case for adding brackets for IPv6 literals only, but avoids changing log outputs in existing installs.
Screenshots
Your Environment
- Version used: Latest "master" branch of Fluent bit as of commit acad02a)
- Configuration: See above
- Environment name and version (e.g. Kubernetes? What version?): Dev container
- Server type and version: n/a
- Operating System and version: Ubuntu 25.10
- Filters and plugins: syslog input
Additional context
This is a purely cosmetic issue. However, the fact that this issue exists, along with #11558, which similarilly makes incorrect assumptions about formatting address:port combinations, indicates that this same type of bug may be present in other places I haven't found yet.