fluent-bit(8)
Fluent Bit is a lightweight log processor and forwarder that collects logs from various sources and sends them to multiple destinations.
Synopsis
fluent-bit [OPTION]... [-c CONFIG_FILE]Description
Fluent Bit is a fast and lightweight log processor and forwarder written in C. It reads logs from system sources (files, syslog, systemd journal), transforms them, and routes them to backends like Elasticsearch, Splunk, S3, Kafka, and HTTP endpoints. Designed for containerized environments and edge computing with minimal resource overhead.
The tool uses a plugin-based architecture with input plugins (sources), filter plugins (transformations), and output plugins (destinations). Configuration is typically done via a main config file plus separate input, filter, and output sections.
Common options
| Flag | What it does |
|---|---|
-c, --config=FILE | path to the configuration file to load |
-e, --plugin=PLUGIN | load an external plugin (e.g., lua script) |
-i, --input=PLUGIN | specify input plugin(s) inline |
-o, --output=PLUGIN | specify output plugin(s) inline |
-f, --filter=PLUGIN | specify filter plugin(s) inline |
-p, --prop="KEY=VALUE" | set plugin properties from command line |
-v, --verbose | increase verbosity level (can be used multiple times) |
-q, --quiet | decrease verbosity; suppress normal output |
-d, --daemon | run fluent-bit as a background daemon |
--dry-run | validate configuration without running the pipeline |
--version | show version and exit |
-h, --help | display help message and exit |
Examples
start fluent-bit with the standard configuration file
fluent-bit -c /etc/fluent-bit/fluent-bit.confread logs from a file and print them to stdout (tail input, stdout output)
fluent-bit -i tail -p Path=/var/log/app.log -o stdoutcollect CPU metrics and send them to Elasticsearch
fluent-bit -i cpu -o es -p Host=elasticsearch -p Port=9200 -p Index=metricsrun with verbose logging to debug configuration issues
fluent-bit -c fluent-bit.conf -vvalidate the configuration file syntax without starting the service
fluent-bit --dry-run -c /etc/fluent-bit/fluent-bit.confstart fluent-bit as a daemon process in the background
fluent-bit -d -c /etc/fluent-bit/fluent-bit.confcollect from syslog and files, forward to Kafka broker
fluent-bit -i syslog -i files -o kafka -p brokers=localhost:9092 -p topics=logsdisplay fluent-bit version number
fluent-bit -c fluent-bit.conf --version