Back to catalog
Fluent Bit
Apache-2.0Fluent Bit is a lightweight C telemetry agent that ingests, filters, and routes logs, metrics, and traces across hybrid nodes with zero dependencies.
Overview
Fluent Bit is a lightweight telemetry agent in C that collects, parses, and forwards logs, metrics, and traces. Its minimal memory footprint and modular architecture allow high-throughput stream processing on edge hosts and container clusters. Because it compiles to a standalone binary without external runtime dependencies, teams deploy it uniformly across Linux, Windows, and embedded systems.
Where Fluent Bit fits
Fluent Bit operates as an edge collector and stream routing layer on compute nodes rather than a centralized log storage or search engine. Modern stacks produce telemetry from diverse sources, including container stdout, systemd journals, and TCP endpoints. Fluent Bit ingests, filters, and routes these streams through more than one hundred built-in plugins, decoupling applications from storage protocols.
Compared to Fluentd or Logstash, Fluent Bit uses substantially less memory and CPU by avoiding Ruby or JVM runtimes. While Vector and the OpenTelemetry Collector also offer modern pipelines, Fluent Bit provides a compact binary with native OTLP bridging and automatic Kubernetes metadata decoration. It can multiplex a stream to multiple destinations simultaneously, routing audit logs to object storage while forwarding errors to OpenSearch. Because it provides no storage engine, teams must pair it with a separate indexing backend to search records.
What it does well
- Pluggable architecture: Includes over one hundred native connectors for log inputs, metric scrapers, filters, and storage endpoints without external runtimes.
- OpenTelemetry bridging: Ingests and exports logs, metrics, and traces using native OTLP formats, connecting legacy infrastructure to OpenTelemetry pipelines.
- In-flight stream processing: Filters, aggregates, and transforms event records in memory using SQL queries before dispatching to remotes.
- Kubernetes enrichment: Enriches container logs with pod names, namespaces, and labels queried directly from the Kubernetes API.
- Filesystem buffering: Complements memory queues with configurable disk buffering to prevent data loss during network outages.
Limitations
- No recursive directory scanning: The tail input plugin cannot automatically traverse nested subdirectories (GitHub issue #2120), requiring explicit directory paths.
