TigerOps
All Integrations
Standardsfluent-bit.conf HTTP output

Fluent Bit Integration

Lightweight log forwarding from Fluent Bit to TigerOps with sub-1MB memory overhead. Kubernetes-native, with automatic metadata enrichment and AI-powered log anomaly detection.

Connect Fluent BitBook a Demo
Setup

How It Works

01

Deploy as DaemonSet or Sidecar

Deploy Fluent Bit as a Kubernetes DaemonSet using the official Helm chart. It auto-discovers pod logs and enriches them with namespace, pod name, and container labels.

02

Add the TigerOps Output

Configure the HTTP output plugin in fluent-bit.conf pointing to the TigerOps ingest endpoint. Fluent Bit handles compression and retry automatically.

03

Enrich with Kubernetes Metadata

Enable the kubernetes filter to attach pod labels, annotations, and namespace metadata to every log record. TigerOps uses this for service-level log grouping.

04

Query and Alert on Logs

Search logs in TigerOps using structured queries. Set volume-based and pattern-based alerts. Correlate log events with Prometheus metrics and distributed traces.

Capabilities

What You Get Out of the Box

Sub-1MB Memory Footprint

Fluent Bit runs with under 1MB of memory overhead per node, making it ideal for resource-constrained environments and edge Kubernetes clusters.

Kubernetes Native

Auto-discovery of pod logs, automatic Kubernetes metadata enrichment, and namespace-based routing — all without any application configuration changes.

Multi-Source Collection

Collect logs from container stdout/stderr, host systemd journal, syslog, TCP/UDP sockets, and custom tail inputs — all forwarded in a single Fluent Bit process.

Field Enrichment & Parsing

Use Lua scripts or built-in parser plugins to parse JSON, regex, and structured formats. Enrich records with deployment version and environment tags before forwarding.

Backpressure Handling

Fluent Bit's filesystem buffering prevents log loss during TigerOps connectivity interruptions. Configurable storage limits keep buffer size under control.

OpenTelemetry Output

Forward logs to TigerOps via the OTLP HTTP output plugin for full OpenTelemetry signal unification alongside traces and metrics from the same pipeline.

Configuration

fluent-bit.conf Output Config

Collect Kubernetes pod logs, enrich with metadata, and forward to TigerOps.

fluent-bit.conf
# fluent-bit.conf — Kubernetes pod log collection + TigerOps output

[SERVICE]
    Flush         5
    Daemon        off
    Log_Level     info
    HTTP_Server   on
    HTTP_Listen   0.0.0.0
    HTTP_Port     2020
    storage.path  /var/log/fluentbit-storage

[INPUT]
    Name              tail
    Tag               kube.*
    Path              /var/log/containers/*.log
    multiline.parser  docker, cri
    DB                /var/log/fluentbit-kube.db
    Mem_Buf_Limit     50MB
    Skip_Long_Lines   on

[FILTER]
    Name                kubernetes
    Match               kube.*
    Kube_URL            https://kubernetes.default.svc:443
    Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
    Merge_Log           on
    K8S-Logging.Parser  on
    K8S-Logging.Exclude on

[OUTPUT]
    Name            http
    Match           kube.*
    Host            ingest.atatus.net
    Port            443
    URI             /api/v1/logs
    Format          json_lines
    Header          Authorization Bearer ${TIGEROPS_API_KEY}
    Header          Content-Type application/x-ndjson
    compress        gzip
    Retry_Limit     10
    tls             on
    tls.verify      on
FAQ

Common Questions

What is the difference between the Fluent Bit and Fluentd integrations?

Fluent Bit is a lightweight, single-purpose log forwarder with a smaller memory footprint. Fluentd is a heavier-weight log aggregator with a richer plugin ecosystem. For Kubernetes node-level collection, TigerOps recommends Fluent Bit. For complex multi-source aggregation pipelines, Fluentd is often more appropriate.

Can Fluent Bit forward metrics to TigerOps as well?

Yes. Fluent Bit 2.0+ includes a metrics pipeline for collecting host CPU, memory, disk, and network metrics. Use the prometheus_remote_write output to forward these to TigerOps alongside log streams.

How do I avoid duplicate logs in multi-container pods?

Use the Exclude_Path option in the tail input to skip log files for containers that ship their own logs via a sidecar. Alternatively, use Kubernetes annotation-based filtering to opt containers in or out of Fluent Bit collection.

Does TigerOps support Fluent Bit running on edge devices?

Yes. Fluent Bit's minimal footprint makes it suitable for IoT edge devices. Configure the http output pointing to TigerOps with local filesystem buffering to handle intermittent connectivity.

Can I parse multiline logs like Java stack traces?

Yes. Fluent Bit's multiline parser (available in v1.8+) can reassemble Java, Python, and Go stack traces before forwarding. Configure the multiline.parser option in the tail input section for each log format.

Get Started

Kubernetes Log Forwarding at Minimal Overhead

Fluent Bit + TigerOps: AI anomaly detection, trace correlation, and structured log search. Deploy in 3 minutes.

Start FreeTalk to an Engineer