Tenzir Node Unreleased

🚀 Features

Re-added pipeline::detach and pipeline::add

Jun 22, 2026 · @IyeOnline · #6364

The pipeline::detach and pipeline::add operators are available again on the new executor.

Call-site annotations in diagnostics from user-defined operators

Jun 11, 2026 · @IyeOnline, @aljazerzen · #6350

Diagnostics from inside a user-defined operator now include source context from the UDO as well as a “called from here” trace back to the top level pipeline. This makes it possible to immediately locate the offending call when a diagnostic is emitted deep in a nested operator:

from {}
test::error

error: assertion failure
 --> <packages/test:error>:2:10
  |
2 |   assert false
  |          ^^^^^
  |
 --> <input>:2:1
  |
2 | test::error
  | ^^^^^^^^^^^ called from here
  |

Previously, such diagnostics contained no location information, making it difficult to associate them with a specific call in the pipeline.

Graceful pipeline shutdown with data draining

May 21, 2026 · @aljazerzen

Stopping a pipeline or shutting down the node now drains in-flight data before terminating, instead of discarding it. Source operators receive a graceful stop signal and can finish outstanding work before the pipeline shuts down.

A configurable grace period (tenzir.shutdown-grace-period, default 30 seconds) bounds how long the system waits. After the grace period expires, remaining pipelines are force-killed.

Automatic input format detection

May 16, 2026 · @mavam, @codex · #6191

The new read_auto operator detects common input formats before choosing a reader:

from_stdin {
  read_auto
}

Detection dry-runs the actual parsers on a bounded probe of the input. When multiple readers are capable of consuming the bytes, the most specific format wins, e.g., Suricata EVE beats generic NDJSON. Formats that accept arbitrary text, such as space-separated values, are never auto-detected; select their readers explicitly instead.

By default, read_auto fails when detection finds no unique match. Use fallback="lines" or fallback="all" to opt into generic line or whole-input reading for otherwise unknown input.

🐞 Bug Fixes

Crash fix for list.add with null-typed record fields

Jun 15, 2026 · @IyeOnline, @claude · #6361

list.add no longer crashes when the existing list contains record elements where one or more fields previously held only null values. Previously, calling list.add with a new element that provided a real value (for example a hostname string) for such a field would trigger an internal assertion failure. The function now correctly widens null-typed fields to accommodate the new element’s type.

Correct null handling in bloom-filter context lookups

Jun 3, 2026 · @IyeOnline, @claude

The bloom-filter context no longer matches null values when the filter was populated with empty strings. Now null values no longer match the context.