Fluxtail
Sign in Start free
Use case / Fluent Bit

Fluent Bit Kubernetes Logs With Fluxtail

Use Fluent Bit as the Kubernetes collector, then forward the records to a Fluxtail receiver and stream. Keep namespace, pod, container, service, severity, request ID, and trace fields available for live tail, filters, facets, histograms, alerts, MCP diagnostics, and AI chat.

Fluent Bit Kubernetes logs Receiver Streams
Start free View pricing
Use Fluent Bit near the workloads

Collect container output close to the node and attach Kubernetes metadata before records leave the cluster.

Forward to a Fluxtail receiver

Send records to the receiver endpoint and key assigned to that Kubernetes source.

Keep fields searchable

Preserve namespace, pod, container, node, service, severity, request ID, and trace ID fields.

Read from one stream

Use Fluxtail streams, live tail, filters, facets, histograms, alerts, MCP diagnostics, and AI chat after forwarding.

Collector

Use Fluent Bit as the Kubernetes collector

Fluent Bit is commonly used for container log collection because it can run near workloads and forward records onward.

01

Collect container output

Use Fluent Bit to read container logs and enrich them with Kubernetes metadata before forwarding.

02

Keep collector work focused

Do parsing, metadata enrichment, and routing at the collector. Keep long-term reading and analysis in the destination stream.

03

Start with one namespace

Forward one namespace or service first so field names and stream routing can be checked before adding more traffic.

Collector proof

Forward Fluent Bit output into a Fluxtail receiver

The exact Fluent Bit parser and Kubernetes filter setup depends on your cluster. The output should preserve the resulting record shape and send it to the Fluxtail receiver.

Fluent Bit output toward Fluxtail
config
1[OUTPUT]
2    Name            http
3    Match           kube.*
4    Host            ${FLUXTAIL_HOST}
5    Port            ${FLUXTAIL_PORT}
6    URI             /log
7    Header          X-API-Key ${FLUXTAIL_API_KEY}
8    Format          json

Use the host, port, path, and authentication values from the Fluxtail receiver assigned to the source.

Resulting record shape in Fluxtail
json
1{
2  "timestamp": "2026-04-24T14:21:09Z",
3  "level": "ERROR",
4  "message": "checkout timeout after 3 retries",
5  "service.name": "checkout-api",
6  "k8s.namespace.name": "storefront",
7  "k8s.pod.name": "checkout-api-7b8f6d8bd5-7nmzl",
8  "k8s.container.name": "app",
9  "stream": "k8s/storefront/checkout-api"
10}

The collector stays upstream. Fluxtail needs enough context on the record to make filtering and live reading useful.

Check the same service in Kubernetes and Fluxtail
output
kubectl logs deploy/checkout-api -n storefront --tail=20
Fluxtail filter: stream=k8s/storefront/checkout-api namespace=storefront service=checkout-api

Use this comparison before expanding the collector configuration to more namespaces.

Receiver

Forward to a Fluxtail receiver

Treat the receiver as the explicit boundary between Kubernetes collection and Fluxtail streams.

01

Use receiver-specific connection values

Use the Fluxtail host, port, path, and API key for the receiver assigned to this Kubernetes source.

02

Route to a named stream

Send production, staging, namespace, or service traffic to streams that match how you search during live reading.

03

Keep retries visible

If Fluent Bit retries or backs off, keep collector logs accessible so missing-log diagnostics have a source to inspect.

Collector proof

Forward Fluent Bit output into a Fluxtail receiver

The exact Fluent Bit parser and Kubernetes filter setup depends on your cluster. The output should preserve the resulting record shape and send it to the Fluxtail receiver.

Fluent Bit output toward Fluxtail
config
1[OUTPUT]
2    Name            http
3    Match           kube.*
4    Host            ${FLUXTAIL_HOST}
5    Port            ${FLUXTAIL_PORT}
6    URI             /log
7    Header          X-API-Key ${FLUXTAIL_API_KEY}
8    Format          json

Use the host, port, path, and authentication values from the Fluxtail receiver assigned to the source.

Resulting record shape in Fluxtail
json
1{
2  "timestamp": "2026-04-24T14:21:09Z",
3  "level": "ERROR",
4  "message": "checkout timeout after 3 retries",
5  "service.name": "checkout-api",
6  "k8s.namespace.name": "storefront",
7  "k8s.pod.name": "checkout-api-7b8f6d8bd5-7nmzl",
8  "k8s.container.name": "app",
9  "stream": "k8s/storefront/checkout-api"
10}

The collector stays upstream. Fluxtail needs enough context on the record to make filtering and live reading useful.

Check the same service in Kubernetes and Fluxtail
output
kubectl logs deploy/checkout-api -n storefront --tail=20
Fluxtail filter: stream=k8s/storefront/checkout-api namespace=storefront service=checkout-api

Use this comparison before expanding the collector configuration to more namespaces.

Fields

Keep Kubernetes fields searchable

Readable Fluxtail streams depend on stable fields from the collector.

01

Use consistent Kubernetes field names

Keep namespace, pod, container, node, and service fields consistent so saved filters and alerts do not break.

02

Preserve severity and message text

Do not bury the human-readable message in a nested blob if it can be kept as a top-level message field.

03

Carry trace and request context

When app logs contain request ID, trace ID, span ID, route, job ID, or tenant fields, forward them with the log row.

Collector proof

Forward Fluent Bit output into a Fluxtail receiver

The exact Fluent Bit parser and Kubernetes filter setup depends on your cluster. The output should preserve the resulting record shape and send it to the Fluxtail receiver.

Fluent Bit output toward Fluxtail
config
1[OUTPUT]
2    Name            http
3    Match           kube.*
4    Host            ${FLUXTAIL_HOST}
5    Port            ${FLUXTAIL_PORT}
6    URI             /log
7    Header          X-API-Key ${FLUXTAIL_API_KEY}
8    Format          json

Use the host, port, path, and authentication values from the Fluxtail receiver assigned to the source.

Resulting record shape in Fluxtail
json
1{
2  "timestamp": "2026-04-24T14:21:09Z",
3  "level": "ERROR",
4  "message": "checkout timeout after 3 retries",
5  "service.name": "checkout-api",
6  "k8s.namespace.name": "storefront",
7  "k8s.pod.name": "checkout-api-7b8f6d8bd5-7nmzl",
8  "k8s.container.name": "app",
9  "stream": "k8s/storefront/checkout-api"
10}

The collector stays upstream. Fluxtail needs enough context on the record to make filtering and live reading useful.

Check the same service in Kubernetes and Fluxtail
output
kubectl logs deploy/checkout-api -n storefront --tail=20
Fluxtail filter: stream=k8s/storefront/checkout-api namespace=storefront service=checkout-api

Use this comparison before expanding the collector configuration to more namespaces.

Verification

Check one stream before expanding

The first successful test is a readable Fluxtail stream, not just a successful HTTP response from the collector.

01

Check recent rows in live tail

Confirm new rows appear while the source is still active.

02

Filter by namespace and service

Confirm common filters work without searching inside message text.

03

Add alerts and diagnostics after fields are stable

Use alerts, facets, histograms, MCP diagnostics, and AI chat after the stream has stable fields and sample volume.

Collector proof

Forward Fluent Bit output into a Fluxtail receiver

The exact Fluent Bit parser and Kubernetes filter setup depends on your cluster. The output should preserve the resulting record shape and send it to the Fluxtail receiver.

Fluent Bit output toward Fluxtail
config
1[OUTPUT]
2    Name            http
3    Match           kube.*
4    Host            ${FLUXTAIL_HOST}
5    Port            ${FLUXTAIL_PORT}
6    URI             /log
7    Header          X-API-Key ${FLUXTAIL_API_KEY}
8    Format          json

Use the host, port, path, and authentication values from the Fluxtail receiver assigned to the source.

Resulting record shape in Fluxtail
json
1{
2  "timestamp": "2026-04-24T14:21:09Z",
3  "level": "ERROR",
4  "message": "checkout timeout after 3 retries",
5  "service.name": "checkout-api",
6  "k8s.namespace.name": "storefront",
7  "k8s.pod.name": "checkout-api-7b8f6d8bd5-7nmzl",
8  "k8s.container.name": "app",
9  "stream": "k8s/storefront/checkout-api"
10}

The collector stays upstream. Fluxtail needs enough context on the record to make filtering and live reading useful.

Check the same service in Kubernetes and Fluxtail
output
kubectl logs deploy/checkout-api -n storefront --tail=20
Fluxtail filter: stream=k8s/storefront/checkout-api namespace=storefront service=checkout-api

Use this comparison before expanding the collector configuration to more namespaces.

Collector proof

Forward Fluent Bit output into a Fluxtail receiver

The exact Fluent Bit parser and Kubernetes filter setup depends on your cluster. The output should preserve the resulting record shape and send it to the Fluxtail receiver.

Fluent Bit output toward Fluxtail
config
1[OUTPUT]
2    Name            http
3    Match           kube.*
4    Host            ${FLUXTAIL_HOST}
5    Port            ${FLUXTAIL_PORT}
6    URI             /log
7    Header          X-API-Key ${FLUXTAIL_API_KEY}
8    Format          json

Use the host, port, path, and authentication values from the Fluxtail receiver assigned to the source.

Resulting record shape in Fluxtail
json
1{
2  "timestamp": "2026-04-24T14:21:09Z",
3  "level": "ERROR",
4  "message": "checkout timeout after 3 retries",
5  "service.name": "checkout-api",
6  "k8s.namespace.name": "storefront",
7  "k8s.pod.name": "checkout-api-7b8f6d8bd5-7nmzl",
8  "k8s.container.name": "app",
9  "stream": "k8s/storefront/checkout-api"
10}

The collector stays upstream. Fluxtail needs enough context on the record to make filtering and live reading useful.

Check the same service in Kubernetes and Fluxtail
output
kubectl logs deploy/checkout-api -n storefront --tail=20
Fluxtail filter: stream=k8s/storefront/checkout-api namespace=storefront service=checkout-api

Use this comparison before expanding the collector configuration to more namespaces.

Related

Related pages

Related page
Kubernetes logging

Practical guide to Kubernetes logging: what metadata to keep, how collection paths work, and how Fluxtail keeps cluster logs searchable.
Related page
Kubernetes log aggregation

Aggregate Kubernetes logs from pods, nodes, and collectors into Fluxtail streams with live tail, filters, facets, histograms, alerts, MCP diagnostics, and AI chat.
Related page
Fluent Bit vs Fluentd

Compare Fluent Bit and Fluentd for log collection, routing, and processing, then send either collector output into Fluxtail streams for live reading.
Related page
OTLP logs

Send OTLP logs from OpenTelemetry SDKs or Collectors into Fluxtail. Learn what fields to preserve and how to verify ingestion.
Related page
Log aggregation

Learn how log aggregation works across apps, hosts, syslog, containers, Kubernetes, OTLP, GELF, and collectors.
Next step

Send one real source and read the logs

The fastest check is to point one real source at Fluxtail and see whether the resulting stream is easier to read.

Point one real source at Fluxtail.

Create a receiver, send one source, and inspect the first stream.

Start free View pricing