Configure Fluent Bit to collect, filter, and forward container logs with Kubernetes metadata enrichment
domain: docs.fluentbit.io · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Deploy Fluent Bit as a DaemonSet using the official Helm chart (fluent/fluent-bit) which mounts /var/log/containers from the node
In the Helm values, configure the INPUT section to use the tail plugin reading from /var/log/containers/*.log with a Parser set to docker or cri depending on your container runtime
Enable the kubernetes FILTER plugin with Kube_URL pointing to the Kubernetes API server; set Merge_Log On to merge embedded JSON log payloads into the top-level record
Add a GREP filter to exclude log records matching a noisy pattern (e.g., health-check paths) using the Exclude directive before the output
Configure the OUTPUT plugin: use the http plugin to forward to an OTLP-compatible endpoint, or the datadog plugin with apikey YOUR_KEY for Datadog log ingestion
Validate the pipeline by running kubectl logs daemonset/fluent-bit and checking for parser errors or dropped records in the Fluent Bit metrics endpoint (/api/v1/metrics)
Known gotchas
Fluent Bit's Kubernetes filter calls the Kubernetes API for every new pod UID; in clusters with high pod churn, enable the Use_Kubelet option to use the local kubelet API and avoid API server rate limits
The Merge_Log option attempts to parse the log field as JSON; if applications emit non-JSON logs, Merge_Log failures emit noisy error messages — set Merge_Log_Trim to avoid partial parsing
Fluent Bit stores file offsets in a database (db.path); if this file is on ephemeral storage it will be lost on pod restart, causing duplicate log delivery from the last checkpoint
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?