---
title: Fluent
slug: telemetry-pipeline/fluent
docTags: 
createdAt: 2025-04-20T16:59:30.771Z
---

## 📍 Connection Basics

- address (required, string)

The socket address to bind to and accept connections.

 Supports direct socket addresses (must include a port) or systemd#{N} if using systemd socket activation.

Example: 127.0.0.1:8080 or systemd#0

- connection\_limit (optional, uint)

Sets a hard limit on how many TCP connections can be active simultaneously.

Useful for controlling resource usage during high traffic.

- receive\_buffer\_bytes (optional, uint)

Buffer size (in bytes) used per connection for incoming data.

Usually doesn't require customization.

Example: 8192

- permit\_origin (optional, \[string])

List of allowed IPs or networks (in CIDR format) for connection.

Acts as an access control mechanism.

Example: \`\["10.0.0.0/8", "192.168.1.0/24"]



## ♻️ TCP Keepalive Settings

- keepalive.time\_secs (optional, uint)

Number of seconds to wait before sending TCP keepalive probes on idle connections.

Helps detect and close dead connections proactively.



## 🔐 TLS (Transport Layer Security)

TLS configuration for encrypting connections and optionally extracting client certificate metadata.



- tls.enabled (optional, bool)

Enables TLS encryption.

Required if secure communication is needed.

 For incoming connections, a server certificate must also be configured (tls.crt\_file, tls.key\_file).



- tls.ca\_file (optional, string)

Path to a CA certificate file used to verify client certificates.

Format: PEM or DER. Can be inline as PEM.

- tls.crt\_file (optional, string)

Path to the server's certificate file.

 Required for secure (TLS) incoming connections.

 PEM, DER, or PKCS#12 supported.

 If not using PKCS#12, tls.key\_file must also be set.

- tls.key\_file (optional, string)

Path to the server's private key file.

Must be in PKCS#8 (PEM or DER) format.

- tls.key\_pass (optional, string)

Passphrase for unlocking an encrypted private key file.

Only used if tls.key\_file is set and encrypted.

- tls.alpn\_protocols (optional, \[string])

List of ALPN protocols (Application-Layer Protocol Negotiation) to advertise.

Prioritized in the order given.

- tls.client\_metadata\_key (optional, string)

If set, client certificate metadata will be added to each event using this key.

- tls.server\_name (optional, string)

Sets the server name for SNI (Server Name Indication).

Relevant only for outgoing TLS connections.

- tls.verify\_certificate (optional, bool)

Enables validation of certificates during TLS handshake.

Validates expiration, chain of trust, and issuer.

⚠️ Disabling this introduces serious security risks.

- tls.verify\_hostname (optional, bool)

Verifies that the hostname in the certificate matches the remote host.

 Only applies to outgoing TLS connections.

⚠️ Do not disable unless you're sure of the implications.





![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/6I1a8CGkHDFs21azf7hvQ_image.png)