Agent v2.22.0

New Prometheus Remote Write source node, browser origin restrictions for ingestion tokens, longer SQS visibility windows for the S3 source, and dependency upgrades to address CVEs.

  2 minute read  

August 4, 2026

New Features

  • Prometheus Remote Write Source: Added a prometheus_remote_write_input source node that receives metrics pushed over the Prometheus remote write protocol. The node runs an HTTP server that accepts protobuf-encoded write requests on /api/v1/write and answers health checks on /healthz and /_/health. It supports server-side TLS, rate limiting, and source metadata.

    nodes:
  - name: my_prometheus_remote_write_input
    type: prometheus_remote_write_input
    listen: 0.0.0.0            # Address to listen on. Default: 0.0.0.0.
    port: 9201                 # Required. Port number to listen on.
    read_timeout: 1m           # How long to wait for incoming data. Default: 1m.
    write_timeout: 10s         # Response write timeout. Default: 10s.
    idle_timeout: 1m           # Idle connection timeout. Default: 1m.
    parallel_worker_count: 2   # Number of workers processing incoming requests.
    channel_size: 1000         # Buffered item count. Default: 1000.

  • HTTP Ingestion Source: Added an allowed_origins field to the http_ingestion_input node that restricts which browser origins may use the node’s ingestion token. It is intended for tokens embedded in public page source, such as those used for real user monitoring. An empty list allows any client, so existing nodes and tokens are unchanged. Once the list is set, the token becomes browser-only and requests without an Origin header are rejected. A whole leading host label can be a wildcard, so https://*.acme.com matches app.acme.com but not the apex domain or evilacme.com.

    nodes:
  - name: my_http_ingestion_input
    type: http_ingestion_input
    allowed_origins:           # Browser origins allowed to use this node's token. Default: empty (no restriction).
      - https://app.acme.com
      - https://*.acme.com

Improvements

  • S3 Source: The agent now sets an extended SQS visibility window when it receives a message and keeps renewing that window while it processes the referenced object. Objects that take longer to process than the queue’s configured visibility timeout are no longer redelivered and processed twice. Renewal stops as soon as the batch is acknowledged.

Security

  • Avro Library Replacement: Replaced the archived hamba/avro library with the maintained iskorotkov/avro fork.
  • Dependency Upgrades: Upgraded klauspost/compress, dlclark/regexp2, spf13/cobra, and Masterminds/semver to address known CVEs.