Implementing Fluent Bit as a Lightweight Log Forwarder

Learners will configure Fluent Bit agents to efficiently collect logs from node-level filesystems and systemd journals within Kubernetes clusters.

In this lesson, you will learn how to configure Fluent Bit to act as a high-performance, lightweight agent that gathers logs directly from your Kubernetes node filesystems and systemd journals.

The Lightweight Log Forwarding Pattern

In a Kubernetes cluster, logs are typically generated by containers and stored in local files under /var/log/containers/ or managed by systemd for node-level services. Running a bulky logging agent on every node can consume significant memory and CPU. Fluent Bit is designed specifically for this role; it is written in C, features a tiny footprint, and uses a modular "Input-Filter-Output" pipeline.

To collect these logs effectively, you deploy Fluent Bit as a DaemonSet. This ensures that one pod runs on every node, inheriting the necessary permissions to access the host's log directories.

Configuring the Pipeline

Fluent Bit uses an input plugin to watch specific sources. To scrape container logs from the filesystem and grab node-level events from systemd, you define these inputs in your configuration:

[INPUT]
    Name              tail
    Path              /var/log/containers/*.log
    Parser            docker
    Tag               kube.*

[INPUT]
    Name              systemd
    Tag               node.systemd
    Systemd_Filter    _SYSTEMD_UNIT=kubelet.service

Tail Input: The tail plugin monitors the container log files. Because Fluent Bit maintains a database file (state), it remembers which log lines it has already sent, ensuring no logs are missed if the agent restarts.
Systemd Input: By reading directly from the systemd journal, you capture critical node events—like Kubelet failures or container runtime errors—that don't exist as standard application logs.

Once collected, you typically use filter_kubernetes to enrich these logs with metadata like the Pod name, Namespace, and labels. This allows you to quickly query logs for a specific application across your entire cluster infrastructure. By shifting this work to a lightweight daemon, you maintain observability without sacrificing the resource efficiency of your worker nodes.

Key Takeaway: By deploying Fluent Bit as a DaemonSet using the tail and systemd input plugins, you create a resource-efficient pipeline that captures both container-level application logs and node-level system events for unified observability.