Define inputs in the pipeline section of your YAML config (or [INPUT] blocks in classic INI format); set the Tag field to a meaningful string like app.myservice so filters can match it with glob patterns
Create a parser (in parsers.yaml or a standalone parsers file) with a matching Regex or JSON format, a Time_Key field name, and a Time_Format string in strptime notation; reference the parser from the input using the Parser field
Add a [FILTER] of type parser pointing at the same Match tag to parse the raw message into structured key-value pairs; set Preserve_Key Off to remove the original unparsed field after parsing
Chain additional filters for enrichment: use the kubernetes filter to attach pod/namespace/label metadata when running as a DaemonSet; use the grep filter with Regex or Exclude rules to drop records matching a pattern
Add a [FILTER] of type modify or record_modifier to rename, add, or remove fields before export
Define [OUTPUT] blocks with the correct Match tag; multiple outputs can share the same tag, and Fluent Bit fans out to all matching outputs
Known gotchas
Parsers are applied per-input, not per-filter; if a log line does not match the parser regex, the record is forwarded unparsed without an error—add a Decode_Field or a second filter to handle unmatched lines explicitly
The kubernetes filter requires the Fluent Bit pod to have RBAC access to the Kubernetes API (pods/get, namespaces/get); missing permissions cause the filter to silently skip metadata enrichment
Tag matching is case-sensitive and uses glob syntax; a filter with Match app.* matches app.web and app.worker but not App.web—ensure consistent casing in input Tag values
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp