RousselTMLEARNING

Article · Fluent Bit and Vector: lightweight log collection

Fluent Bit: pipeline and configuration

This article is available in French.

1. Le pipeline #

Six étapes.

Concepts #

Pipeline Fluent Bit
Le routage se fait par tags : chaque output choisit les enregistrements dont le tag correspond à son match.
ÉtapeRôle
InputLit les données et leur attribue un tag (par exemple kube.*)
ParserTransforme une ligne brute en enregistrement structuré
FilterEnrichit, modifie ou supprime des enregistrements
BufferStocke en mémoire ou sur disque avant l'envoi
RouterAssocie tags et outputs via match
OutputEnvoie vers la destination, avec réessais

2. La configuration YAML #

Le format recommandé.

Exemple complet #

service:
  flush: 1
  log_level: info
  http_server: on          # métriques et santé sur le port 2020
  http_listen: 0.0.0.0
  http_port: 2020
  storage.path: /var/lib/fluent-bit/buffer

parsers:
  - name: app_json
    format: json
    time_key: ts
    time_format: '%Y-%m-%dT%H:%M:%S.%LZ'

pipeline:
  inputs:
    - name: tail
      path: /var/log/app/*.log
      tag: app.*
      parser: app_json
      db: /var/lib/fluent-bit/tail.db     # positions de lecture
      mem_buf_limit: 50MB
      storage.type: filesystem
  filters:
    - name: grep
      match: app.*
      exclude: path ^/health
    - name: modify
      match: app.*
      add: [env production]
      remove: password
  outputs:
    - name: loki
      match: app.*
      host: loki
      port: 3100
      labels: job=fluent-bit, env=production
    - name: es
      match: app.*
      host: elasticsearch
      port: 9200
      logstash_format: on
      suppress_type_name: on
fluent-bit -c fluent-bit.yaml
fluent-bit -c fluent-bit.yaml --dry-run   # valider sans démarrer
À savoir : L'ancien format « classique » (sections [INPUT], [OUTPUT]) reste pris en charge ; le YAML est recommandé pour les nouvelles installations.

3. Plugins essentiels #

Ceux qu'on utilise partout.

Sélection #

TypePluginUsage
InputtailFichiers (dont les logs de conteneurs)
InputsystemdJournal systemd
Inputforward, opentelemetryRéception depuis Fluentd/Fluent Bit ou en OTLP
FilterkubernetesAjoute namespace, pod, labels, annotations
Filtergrep, modify, nestFiltrer, renommer, restructurer
FilterluaTransformation libre en Lua
Filterrewrite_tagRe-router selon le contenu
Outputloki, es, opensearchStockage des logs
Outputs3, kafka, opentelemetryArchivage, bus, OTLP

📄 Fluent Bit : pipeline, configuration et plugins essentiels →

My progress

  • ⏱ Estimated time : ≈ 8 min

Sign in to track your progress and take notes. Sign in

✉️ Ask a question

Recommended Articles

Understanding the concept of score

The concept of score allows Elasticsearch to rank your documents by relevance during a search.

Understanding the Elastic Common Schema (ECS)

As always in our consulting engagements, we recommend that companies harmonise and standardise: k...

License consumption types

Understand the evolution of billing in Dynatrace: the difference between the old licensing model ...

Grafana Alloy: The importance of Self-Monitoring

Discover why and how to configure Grafana Alloy so that it monitors itself, collecting its own lo...

Grafana Alloy: Understanding and exploiting the User Interface (UI)

Discover how to enable, secure, and use Grafana Alloy's built-in web interface to visualize your ...

Grafana Alloy: Introduction and Architecture

Discover the fundamental concepts of Grafana Alloy, the transition from the static Agent to Alloy...

Grafana Alloy: Syntax and Configuration (Alloy Language: River)

As part of a Grafana training or observability training, master the declarative syntax of Grafana...

Grafana Alloy: Metrics Collection (Prometheus & Ecosystem)

Learn how to configure Grafana Alloy to collect, transform, and forward metrics using the Prometh...

Grafana Alloy: Log Management with Loki

Discover how to configure Grafana Alloy to read log files, journald, or network streams, process ...