Agent v2.23.0

August 12, 2026

New Features

• HTTP Source Nodes: Added a max_connection_age field to HTTP-based source nodes, such as the HTTP source, OTLP source, Splunk HEC source, and Datadog source. Once a keep-alive connection has been open longer than this duration, the server asks the client to reconnect after the current request. A load balancer that routes per connection can then redistribute traffic across pods. The value is jittered by plus or minus 10 percent so connections opened together do not all close at once. The default is 0s, which keeps connections open indefinitely. http_input nodes that share a port must all use the same value. This setting was previously available on gRPC nodes only.

  nodes:
    - name: my_http_input
      type: http_input
      port: 9090
      max_connection_age: 30m    # Maximum lifetime of a keep-alive connection. Default: 0s (no limit).
  

• Log to Pattern: Added a sample_field_path field to the log_to_pattern and log_to_pattern_metric processors that selects which field is stored as the cluster sample. Use it when field_path clusters on a derived field but the samples should still show the original log. If it is not set, the clustered field is used.

  nodes:
    - name: my_log_to_pattern
      type: log_to_pattern
      field_path: item["attributes"]["payload"]   # Field used for clustering.
      sample_field_path: item["body"]             # Field stored as the cluster sample. Default: the clustered field.
  

• Log to Pattern: The log_to_pattern and log_to_pattern_metric processors also accept a max_token_count field, which sets how many tokens are kept from each line for clustering. Raise it when logs carry more fields than the default captures, at the cost of memory. It accepts values between 10 and 200, and the default is 50.

  nodes:
    - name: my_log_to_pattern
      type: log_to_pattern
      max_token_count: 80        # Tokens kept from each line for clustering. Range: 10-200. Default: 50.