FerroStash is a Logstash-compatible log and event pipeline in Rust — .conf DSL, filter chain, Beats input, Elasticsearch output — as a single small binary. It is the one Ferro product whose source is public: abyo-software/ferro-stash. Also live on AWS Marketplace.

Measured record (as of 2026-07-10)

Development started earlier in a private repository; the public history begins at the 2026-06-19 re-cut.

Quality gates passed

• Byte-equivalence conformance against real Logstash — 13 harness cases where FerroStash output is compared byte-for-byte with Logstash output for the same config and input.
• The interesting bugs were exactly the ones a harness catches and code review doesn’t: Logstash renders dates as .000Z where a naive port produces +00:00; \X escape semantics in the DSL; else if / else chain behavior. All three were found by the harness and fixed against it.
• Fuzzing found a real protobuf-input crash pre-release; fixed with the crash input kept as a regression seed.

Honest limitations

• Plugin coverage is the useful core (the inputs/filters/outputs the conformance harness exercises), not Logstash’s full plugin catalog.
• The public history starts at the 2026-06-19 re-cut; earlier development is not browsable.