Agent v2.24.0

September 4, 2026

New Features

• GCS Source: The key and key_path fields are now optional. When neither is set, the agent authenticates with Application Default Credentials, which covers Workload Identity on GKE and Cloud Run. Setting both at once is still rejected. key_path also accepts a workload identity federation credential configuration file.

  nodes:
    - name: my_gcs_input
      type: gcs_input
      project_id: "my-gcp-project"
      sub_id: "edgedelta-gcs-sub"
      # key and key_path both omitted: authenticate with Application Default Credentials.
  

• Agent Settings: Added a batch_settings block with an enabled field. When enabled, inputs that have a batch fast path carry a whole decoded request through the graph as a single batch item instead of one item per data point, which reduces per-item overhead on high-volume pushes. The Prometheus Remote Write source is the first input to use it. The block is off by default.

  settings:
    ...
    batch_settings:
      enabled: true            # Carry decoded requests as single batch items. Default: false.
  

• Helm Charts: Added livenessProbe, readinessProbe, startupProbe, lifecycle, and terminationGracePeriodSeconds values to the workloads in the node agent, gateway, and coordinator charts. In the node agent chart the daemonset and the processor deployment share the deployment key, while the aggregator, compactor, rollup, and target allocator each have their own. A podDisruptionBudget block was added to the same workloads, apart from the daemonset and the coordinator. Probes and lifecycle hooks are empty by default, and the pod disruption budget is disabled.

  deployment:
    ...
    livenessProbe: {}          # Empty by default.
    readinessProbe: {}
    startupProbe: {}
    lifecycle: {}
    terminationGracePeriodSeconds: 10
    podDisruptionBudget:
      enabled: false           # Default: false.
      minAvailable:            # Set exactly one of minAvailable or maxUnavailable.
      maxUnavailable:
  

• Helm Charts: Added an rbac.scope value that selects between cluster-scoped and namespace-scoped RBAC. With cluster, the chart creates a ClusterRole and ClusterRoleBinding from clusterRoleRules. With namespace, it creates a Role and RoleBinding in the release namespace from the new roleRules value. A Role cannot grant access to cluster-scoped resources, so node-level metrics and cluster-wide discovery are unavailable with namespace scope. The target allocator keeps its own cluster-scoped RBAC when it is enabled. Rules in clusterRoleRules, additionalClusterRoleRules, and roleRules now also accept resourceNames.

  rbac:
    scope: cluster             # One of cluster or namespace. Default: cluster.
  roleRules:                   # Used when rbac.scope is namespace.
    - apiGroups: [""]
      resources: ["pods"]
      verbs: ["get", "list", "watch"]
  

Improvements

• Splunk TCP Source: Reworked the S2S v4 implementation and corrected v3 capability negotiation. The node now parses the forwarder’s acknowledgment capability, sends a _time header, and rejects a frame larger than the maximum size with a message naming the likely cause instead of continuing to read the stream. A Splunk destination sending over this protocol also falls back to the node-level index when an item carries none.
• Splunk Destination: Failures evaluating an optional mapper field are now recorded as ed.pipeline.node.miss and logged as warnings rather than counted as node errors, since they usually mean an item does not carry the field the expression reads. A failure on the required event field is still reported as an error.
• Pipeline Validation: Validation errors on list fields are now keyed by the position of the entry that failed, such as allowed_origins.0 or resource_fields.pod_labels.2, so the pipeline editor can mark the specific entry rather than the whole list.

Bug Fixes

• OTLP Source: Trace and span IDs sent as hex in OTLP/JSON logs, metrics, and traces payloads are now normalized before validation, so requests from clients that follow the OTLP/JSON encoding are accepted.
• OTTL: Added cycle detection to OTTL type conversion, so a statement that makes a map or slice contain itself terminates instead of recursing.

Security

• Go Runtime Upgrade: Upgraded the Go runtime to 1.26.6 to address known vulnerabilities.
• Dependency Upgrades: Upgraded google/cel-go, valyala/fasthttp, cilium/ebpf, golang.org/x/mod, golang.org/x/net, golang.org/x/crypto, golang.org/x/text, antlr4-go/antlr, and andybalholm/brotli to address known CVEs.