Fluent bit syslog input does not properly surround IPv6 literals with [] when using source_address_key #11558
Description
Bug Report
Describe the bug
For IPv6 addresses, you can't just tack a colon and a port number at the end of an IPv6 literal and call it a day. Because if you want to represent, for example, the IPv6 address 2001:db8::1 and port 80, you can't just write "2001:db8::1:80", because that makes the :80 part look like it's part of the IPv6 address, causing ambiguity in parsing.
Unfortunately, when using the source_address_key setting to include source IP information in the syslog input, the source field, which is in a URL format, does not properly add brackets.
[0] syslog: [[1773566264.618626000, {}], {"pri"=>"13", "time"=>"2026-03-15T09:17:44.618626+00:00", "host"=>"ace7e86ecd9f", "ident"=>"fluent-bit", "pid"=>"-", "msgid"=>"-", "extradata"=>"[timeQuality tzKnown="1" isSynced="1" syncAccuracy="23500"]", "message"=>"hello there", "source"=>"udp://::1:41700"}]
Note that the source is udp://::1:41700, which can be misinterpreted as 0:0:0:0:0:0:1:41700 (incidentally, not a legal IPv6 address, but only because the source port here happens to be longer than 4 digits, if the source port had been 4 digits long, it would have happened to be a legal IPv6 address.)
To Reproduce
- Steps to reproduce the problem:
Create a fluent bit configuration like this test one:
[SERVICE]
flush 1
daemon Off
log_level info
parsers_file ../conf/parsers.conf
[INPUT]
name syslog
tag syslog
listen ::
mode udp
parser syslog-rfc5424
source_address_key source
[OUTPUT]
name stdout
match *
Run fluent bit with this configuration using a command similar to ../build/bin/fluent-bit -c syslog-to-stdout.conf
Send a test message into the logger to IPv6 localhost using a command similar to logger -d -n ::1 -P 5140 --rfc5424 "hello there"
Observe the "source" key in the output with the malformed URL input. Example:
[0] syslog: [[1773566264.618626000, {}], {"pri"=>"13", "time"=>"2026-03-15T09:17:44.618626+00:00", "host"=>"ace7e86ecd9f", "ident"=>"fluent-bit", "pid"=>"-", "msgid"=>"-", "extradata"=>"[timeQuality tzKnown="1" isSynced="1" syncAccuracy="23500"]", "message"=>"hello there", "source"=>"udp://::1:41700"}]
Expected behavior
For URLs, Fluent Bit should follow the guidance in RFC 3986 section 3.2.2, which boils down to adding square brackets around IPv6 literals in URLs, in order to disambiguate the use of colons as seperators in IPv6 addresses from the use of colons as an address/port seperator. In the example above, the appropriate source URL would be udp://[::1]:41700.
Screenshots
Your Environment
- Version used: Latest "master" branch of Fluent bit as of commit acad02a)
- Configuration: See above
- Environment name and version (e.g. Kubernetes? What version?): Dev container
- Server type and version: n/a
- Operating System and version: Ubuntu 25.10
- Filters and plugins: syslog input
Additional context
This is blocking me from running Fluent Bit in a dual-stack environment, since it causes my "source" address keys to be mangled and unreadable. It should possible for me to unmangle them using some kind of filter, but I shouldn't have to do it, and if I end up using a filter, it'll probably break once this is actually fixed.