Skip to content

Fluent bit syslog input startup message not properly handling IPv6 literals #11559

@pv2b

Description

@pv2b

Bug Report

Describe the bug
For IPv6 addresses, you can't just tack a colon and a port number at the end of an IPv6 literal and call it a day. Because if you want to represent, for example, the IPv6 address 2001:db8::1 and port 80, you can't just write "2001:db8::1:80", because that makes the :80 part look like it's part of the IPv6 address, causing ambiguity in parsing.

Unfortunately, when using the syslog input plugin, this is exactly what happens in an informational log message on startup, as per this example, when binding to ::

[2026/03/15 08:59:37.712] [ info] [in_syslog] UDP server binding :::5140

To Reproduce
Run fluent-bit with this config:

[SERVICE]
    flush        1
    daemon       Off
    log_level    info
    parsers_file ../conf/parsers.conf

[INPUT]
    name         syslog
    tag          syslog
    listen       ::
    mode         udp
    parser       syslog-rfc5424
    source_address_key source

[OUTPUT]
    name         stdout
    match        *

Observe this log message at startup:

[2026/03/15 08:59:37.712] [ info] [in_syslog] UDP server binding :::5140

Expected behavior
The log message should not represent IPv6 addreses and ports in an ambigious way.

Two possible alternative options:

[2026/03/15 08:59:37.712] [ info] [in_syslog] UDP server binding :: port 5140
[2026/03/15 08:59:37.712] [ info] [in_syslog] UDP server binding [::]:5140

I think the first one is easier, and is a simple template string adjustment. The second one requires a special case for adding brackets for IPv6 literals only, but avoids changing log outputs in existing installs.

Screenshots

Your Environment

  • Version used: Latest "master" branch of Fluent bit as of commit acad02a)
  • Configuration: See above
  • Environment name and version (e.g. Kubernetes? What version?): Dev container
  • Server type and version: n/a
  • Operating System and version: Ubuntu 25.10
  • Filters and plugins: syslog input

Additional context
This is a purely cosmetic issue. However, the fact that this issue exists, along with #11558, which similarilly makes incorrect assumptions about formatting address:port combinations, indicates that this same type of bug may be present in other places I haven't found yet.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions