# Tenzir Node v5.25.1

This release includes several bug fixes for the JSON parser, `where`, `replace`, and `if` operators, along with Kafka decompression support and a new `raw_message` option for the `read_syslog` operator.

## 🚀 Features

### Raw message field support for read\_syslog operator

Jan 27, 2026 · [@mavam](https://github.com/mavam), [@claude](https://github.com/claude) · [#5687](https://github.com/tenzir/tenzir/pull/5687)

The `read_syslog` operator now supports a `raw_message` parameter that preserves the original, unparsed syslog message in a field of your choice. This is useful when you need to retain the exact input for auditing, debugging, or compliance purposes.

When you specify `raw_message=<field>`, the operator stores the complete input message (including all lines for multiline messages) in the specified field. This works with all syslog formats, including RFC 5424, RFC 3164, and octet-counted messages.

For example:

```tql
read_syslog raw_message=original_input
```

This stores the unparsed message in the `original_input` field alongside the parsed structured fields like `hostname`, `app_name`, `message`, and others.

## 🐞 Bug Fixes

### Fix overzealous constant evaluation in `if` statements

Jan 30, 2026 · [@jachris](https://github.com/jachris) · [#5701](https://github.com/tenzir/tenzir/pull/5701)

The condition of `if` statements is no longer erroneously evaluated early when it contains a lambda expression that references runtime fields.

### Support decompression for Kafka operators

Jan 30, 2026 · [@raxyte](https://github.com/raxyte), [@claude](https://github.com/claude) · [#5697](https://github.com/tenzir/tenzir/pull/5697)

Kafka connectors now support decompressing messages with `zstd`, `lz4` and `gzip`.

### Fix intermittent UTF-8 errors in JSON parser

Jan 29, 2026 · [@jachris](https://github.com/jachris), [@claude](https://github.com/claude) · [#5698](https://github.com/tenzir/tenzir/pull/5698)

The JSON parser no longer intermittently fails with “The input is not valid UTF-8” when parsing data containing multi-byte UTF-8 characters such as accented letters or emojis.

### Fix assertion failure in replace operator when replacing with null

Jan 29, 2026 · [@mavam](https://github.com/mavam), [@claude](https://github.com/claude) · [#5696](https://github.com/tenzir/tenzir/pull/5696)

The `replace` operator no longer triggers an assertion failure when using `with=null` on data processed by operators like `ocsf::cast`.

```tql
load_file "dns.json"
read_json
ocsf::cast "dns_activity"
replace what="", with=null
```

### Where operator optimization for optional fields

Jan 28, 2026 · [@jachris](https://github.com/jachris), [@claude](https://github.com/claude)

The `where` operator optimization now correctly handles optional fields marked with `?`. Previously, the optimizer didn’t account for the optional marker, which could result in incorrect query optimization. This fix ensures that optional field accesses are handled properly without affecting the optimization of regular field accesses.

[ Download on GitHub ](https://github.com/tenzir/tenzir/releases/tag/v5.25.1)

[Get the release artifacts and source code.](https://github.com/tenzir/tenzir/releases/tag/v5.25.1)