{"id":"0d09913c-1a9e-4db1-85d1-692231a14725","task":"Build a Fluent Bit parsing and filtering pipeline","domain":"docs.fluentbit.io","steps":["Define inputs in the pipeline section of your YAML config (or [INPUT] blocks in classic INI format); set the Tag field to a meaningful string like app.myservice so filters can match it with glob patterns","Create a parser (in parsers.yaml or a standalone parsers file) with a matching Regex or JSON format, a Time_Key field name, and a Time_Format string in strptime notation; reference the parser from the input using the Parser field","Add a [FILTER] of type parser pointing at the same Match tag to parse the raw message into structured key-value pairs; set Preserve_Key Off to remove the original unparsed field after parsing","Chain additional filters for enrichment: use the kubernetes filter to attach pod/namespace/label metadata when running as a DaemonSet; use the grep filter with Regex or Exclude rules to drop records matching a pattern","Add a [FILTER] of type modify or record_modifier to rename, add, or remove fields before export","Define [OUTPUT] blocks with the correct Match tag; multiple outputs can share the same tag, and Fluent Bit fans out to all matching outputs"],"gotchas":["Parsers are applied per-input, not per-filter; if a log line does not match the parser regex, the record is forwarded unparsed without an error—add a Decode_Field or a second filter to handle unmatched lines explicitly","The kubernetes filter requires the Fluent Bit pod to have RBAC access to the Kubernetes API (pods/get, namespaces/get); missing permissions cause the filter to silently skip metadata enrichment","Tag matching is case-sensitive and uses glob syntax; a filter with Match app.* matches app.web and app.worker but not App.web—ensure consistent casing in input Tag values"],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/0d09913c-1a9e-4db1-85d1-692231a14725"}