Fluent Bit

Definition

Fluent Bit is a lightweight, open-source log and metrics processor and forwarder written in C, designed to collect data from files, systems, and applications and route it to storage or analytics backends with minimal memory and CPU overhead. It is commonly deployed as a per-node or per-container agent in Kubernetes and other resource-constrained environments, and is maintained as a Cloud Native Computing Foundation graduated project alongside its sibling Fluentd.

Overview

Centralized logging requires an agent on every host or container that can tail log files, parse them, and ship the results somewhere queryable, but running a heavyweight collector on every node in a large cluster can itself become a meaningful resource cost. Fluent Bit was created by the makers of Fluentd specifically to address that constraint: it is a much smaller, faster, dependency-free binary built in C rather than Fluentd's Ruby-based core, aimed at environments like Kubernetes where thousands of lightweight agent instances may run simultaneously. Fluent Bit processes data through a pipeline of inputs, parsers, filters, and outputs, similar in shape to Fluentd and Telegraf. Input plugins tail log files, listen on network ports, or read container runtime logs; parsers convert raw text into structured records; filters can enrich, modify, or drop records as they pass through; and output plugins send the final structured data to one or more destinations, such as Elasticsearch, Loki, Kafka, or cloud logging services. Its small footprint comes from a design that avoids per-record garbage collection overhead and keeps the core dependency-free, which is why a single Fluent Bit process can run comfortably as a DaemonSet sidecar on every node in a large Kubernetes cluster. Fluent Bit is often positioned as the lighter sibling to Fluentd: Fluentd has a larger plugin ecosystem and more processing flexibility through Ruby-based plugins, while Fluent Bit trades some of that flexibility for a smaller resource footprint and faster startup, making it the more common choice specifically for edge collection at the node or container level. It also overlaps functionally with Telegraf for metrics and with Logstash in the Elastic Stack for log processing, though Fluent Bit's core focus remains lightweight collection and forwarding rather than heavy in-pipeline transformation. In practice, Fluent Bit is the default or recommended log collector in many Kubernetes distributions and managed logging setups, running as a DaemonSet that tails container stdout/stderr logs from every node and forwards them, often after adding Kubernetes metadata like pod and namespace labels, to a backend such as Elasticsearch, Loki, or a cloud provider's logging service. It is also embedded inside other tools and platforms as a built-in log-shipping component due to its small size. The main limitation is that Fluent Bit's plugin ecosystem and in-pipeline processing capability, while substantial, is narrower than Fluentd's, so highly complex transformation logic sometimes still routes through Fluentd or a dedicated stream processor downstream. Teams that need maximum plugin coverage and scripting flexibility in the collection layer itself may still choose Fluentd, reserving Fluent Bit for the common case of high-volume, resource-constrained collection where a lean footprint matters most.

Key Features

• Written in C for minimal memory and CPU footprint per instance
• Runs as a DaemonSet or sidecar for per-node log collection in Kubernetes
• Uses an input-parser-filter-output pipeline architecture
• Supports dozens of output destinations including Elasticsearch, Loki, and Kafka
• Adds Kubernetes metadata enrichment to container logs automatically
• Requires no external runtime dependencies to operate
• Is a CNCF graduated project with broad cloud-native adoption
• Complements or replaces Fluentd in resource-constrained environments

Use Cases

Alternatives

Frequently Asked Questions

Related in DevOps