From aa7552270883705d799bb27da0b2bc7e91ffe0bd Mon Sep 17 00:00:00 2001 From: Shizuo Fujita Date: Wed, 12 Aug 2026 10:12:03 +0900 Subject: [PATCH 1/2] out_forward: document undocumented parameters and Plugin Helpers Four parameters accepted by out_forward had no entry on the page, and the service_discovery helper was missing from Plugin Helpers. * transport (0.14.12) enum, tcp * read_interval_msec (0.14.5) integer, 50 * read_length (0.14.5) size, 512 * tls_ca_cert_path (1.3.1) array of string, nil * tls_cert_path carried the description of tls_ca_cert_path, which took over the CA certificate role when it was renamed in v1.3.1 * the example closed with , and the dns_round_robin note recommended heartbeat_type tcp, deprecated since v0.14.12 in favor of transport Signed-off-by: Shizuo Fujita --- output/forward.md | 57 ++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 54 insertions(+), 3 deletions(-) diff --git a/output/forward.md b/output/forward.md index 87a4768a..8b99c23b 100644 --- a/output/forward.md +++ b/output/forward.md @@ -56,6 +56,7 @@ See [Output Plugin Overview](./) for more details. * [`timer`](../plugin-helper-overview/api-plugin-helper-timer.md) * [`thread`](../plugin-helper-overview/api-plugin-helper-thread.md) * [`compat_parameters`](../plugin-helper-overview/api-plugin-helper-compat_parameters.md) +* [`service_discovery`](../plugin-helper-overview/api-plugin-helper-service_discovery.md) ## Parameters @@ -180,9 +181,19 @@ Use service discovery plugin instead of fixed `` list. See also [Service @type file path /path/to/servers.yaml - + ``` +### `transport` + +| type | default | available | version | +| :--- | :--- | :--- | :--- | +| enum | tcp | tcp, tls | 0.14.12 | + +The transport protocol used to connect to the destination servers. + +Set `tls` to use TLS. All the `tls_*` parameters take effect only with `transport tls`. See [How to connect to a TLS/SSL enabled server?](#how-to-connect-to-a-tlsssl-enabled-server) for a complete configuration. + ### `require_ack_response` | type | default | version | @@ -201,6 +212,28 @@ This option is used when `require_ack_response` is `true`. This default value is If set `0`, this plugin does not wait for the ack response. +### `read_interval_msec` + +| type | default | version | +| :--- | :--- | :--- | +| integer | 50 | 0.14.5 | + +The wait time in milliseconds before retrying to read the handshake response from a server. + +The handshake is a part of the authentication, so this parameter takes effect only when the [``](#security-section) section is configured. + +### `read_length` + +| type | default | version | +| :--- | :--- | :--- | +| size | 512 | 0.14.5 | + +The read size for the data which this plugin receives from a server. + +It applies to the handshake response of the [``](#security-section) section, the ack response of [`require_ack_response`](#requireackresponse) and the heartbeat response of `heartbeat_type udp`. + +This is a low-level tuning parameter, so you rarely need to change it. + ### `send_timeout` | type | default | version | @@ -233,6 +266,10 @@ The wait time before accepting a server fault recovery. Specifies the transport protocol for heartbeats. Set `none` to disable. +The default value `transport` means the protocol which [`transport`](#transport) specifies. + +`tcp` is deprecated since v0.14.12. It is treated as `transport`. + ### `heartbeat_interval` | type | default | version | @@ -283,7 +320,7 @@ Sets TTL to expire DNS cache in seconds. Set 0 not to use DNS Cache. Enable client-side DNS round robin. Uniform randomly pick an IP address to send data when a hostname has several IP addresses. -`heartbeat_type udp` is not available with `dns_round_robintrue`. Use `heartbeat_type tcp` or `heartbeat_type none`. +`heartbeat_type udp` is not available with `dns_round_robin true`. Use `heartbeat_type transport` or `heartbeat_type none`. ### `ignore_network_errors_at_startup` @@ -376,13 +413,27 @@ If the following conditions are met, you must set `tls_verify_hostname false` ex * specify `host` in `` section with IP address, not hostname * specify server certificate file with `tls_cert_path` which contains common name (CN) field with IP address, not hostname +### `tls_ca_cert_path` + +| type | default | version | +| :--- | :--- | :--- | +| array of string | nil | 1.3.1 | + +The additional CA certificate path for TLS. + +This is the new name of [`tls_cert_path`](#tlscertpath), which was renamed in v1.3.1 to clarify its meaning. + ### `tls_cert_path` | type | default | version | | :--- | :--- | :--- | | array of string | nil | 0.14.12 | -The additional CA certificate path for TLS. +The additional certificate path for TLS. + +This parameter was the one for the CA certificate until v1.3.0. [`tls_ca_cert_path`](#tlscacertpath) took over that role in v1.3.1. + +Both parameters end up in the same certificate store. If both are set, only this parameter is used. ### `tls_client_cert_path` From 75616c485c83b6367894298e447bd5eaed32a656 Mon Sep 17 00:00:00 2001 From: Shizuo Fujita Date: Thu, 13 Aug 2026 13:35:54 +0900 Subject: [PATCH 2/2] Clarify tls_ca_cert_path and tls_cert_path precedence Only tls_cert_path takes effect when both are set, so state it in both sections instead of describing them as sharing one certificate store. Signed-off-by: Shizuo Fujita --- output/forward.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/output/forward.md b/output/forward.md index 8b99c23b..483fdbf0 100644 --- a/output/forward.md +++ b/output/forward.md @@ -423,6 +423,8 @@ The additional CA certificate path for TLS. This is the new name of [`tls_cert_path`](#tlscertpath), which was renamed in v1.3.1 to clarify its meaning. +If both of this parameter and [`tls_cert_path`](#tlscertpath) are specified, `tls_cert_path` is used and this parameter is NOT used. + ### `tls_cert_path` | type | default | version | @@ -433,7 +435,7 @@ The additional certificate path for TLS. This parameter was the one for the CA certificate until v1.3.0. [`tls_ca_cert_path`](#tlscacertpath) took over that role in v1.3.1. -Both parameters end up in the same certificate store. If both are set, only this parameter is used. +If both of [`tls_ca_cert_path`](#tlscacertpath) and this parameter are specified, this parameter is used and `tls_ca_cert_path` is NOT used. ### `tls_client_cert_path`