ConfigGenerator

Fluent Bit Config Generator

Generate production-ready Fluent Bit configurations with inputs, filters, outputs, parsers, and TLS. Lightweight log collection for Kubernetes, Docker, and systemd.

Output:A ready-to-use configuration file for Fluent Bit Config with best practices applied.

Fluent Bit Settings

Inputs (1)

Filters (0)

Outputs (1)

fluent-bit.conf
Ready
1[SERVICE]
2    Flush            5
3    Log_Level        info
4    Daemon           Off
5    Parsers_File     parsers.conf
6    HTTP_Server      On
7    HTTP_Listen      127.0.0.1
8    HTTP_Port        2020
9    Health_Check     On
10

11[INPUT]
12    Name            tail
13    Tag             var.log.*
14    Path            /var/log/containers/*.log
15    Parser          cri
16    DB              /var/log/flb_kube.db
17    DB.lock         true
18    Refresh_Interval  10
19    Mem_Buf_Limit   16MB
20    Skip_Long_Lines On
21

22[OUTPUT]
23    Name            stdout
24    Match           *
25    Format          json_lines
26    Flush_interval  5
27    Retry_Limit     5
Not generated yet

What is this tool?

The Fluent Bit Config Generator produces production-ready Fluent Bit configurations for lightweight, high-performance log collection. Fluent Bit is an open-source log processor and forwarder part of the Fluentd ecosystem, written in C with a minimal memory footprint (~1MB) making it ideal for edge deployments, Kubernetes DaemonSets, and resource-constrained environments.

Fluent Bit uses an INI-style configuration file with [SERVICE], [INPUT], [FILTER], [OUTPUT], and [PARSER] sections. This generator abstracts the syntax complexities, letting you visually configure inputs, filters, outputs, parsers, TLS, and buffering to produce a perfectly valid configuration.

How to Use This Tool

1. Service Configuration: Defines global settings like flush interval, log level, daemon mode, and the path to parsers files. The HTTP server enables Prometheus-compatible metrics at port 2020.

2. Define Inputs: Inputs specify where logs come from. Use tail for files, forward for network forwarding, systemd for journal logs, docker for container logs, kube for Kubernetes metadata enrichment, or tcp/udp/mqtt for streaming sources.

3. Configure Filters: Filters transform and enrich log records. The kubernetes filter adds pod metadata, grep matches patterns, parser applies custom parsers, and modify adds/removes fields.

4. Set Outputs: Outputs route logs to destinations. Choose from Elasticsearch, Loki, Kafka, S3, Datadog, CloudWatch, Splunk, Prometheus, and more. Each output supports buffering, TLS, retry policies, and format options.

5. Add Parsers: Parsers define how raw log lines are structured. Built-in parsers handle JSON, regex, logfmt, combined, NGINX, Apache, Docker, and CRI formats.

Best Practices

  • Always set <code>Mem_Buf_Limit</code> on inputs to prevent out-of-memory conditions — start with 16MB and scale based on throughput.
  • Use the <code>kubernetes</code> filter with <code>Merge_Log On</code> and <code>Kube_Tag_Prefix</code> to properly enrich container logs with pod metadata.
  • Enable the HTTP server in the SERVICE section for Prometheus metrics collection and health checking.
  • Configure <code>Retry_Limit</code> on outputs to handle transient failures gracefully without losing logs.
  • Use <code>DB</code> and <code>DB.lock</code> on tail inputs to track file offsets across restarts, preventing duplicate log delivery.
  • Set <code>Refresh_Interval</code> to control how often Fluent Bit checks for new log lines — lower values reduce latency but increase CPU usage.
  • Use TLS encryption for all network-forwarding inputs and outputs in production environments.
  • Keep Fluent Bit configurations modular using <code>Include</code> directives to separate inputs, filters, and outputs into distinct files.

Common Mistakes

  • Setting <code>Mem_Buf_Limit</code> too low causes Fluent Bit to drop logs when downstream outputs are slow or unavailable.
  • Forgetting to set <code>DB</code> on tail inputs causes duplicate logs to be reprocessed after Fluent Bit restarts.
  • Not configuring <code>Retry_Limit</code> on outputs can lead to infinite retry loops that consume resources.
  • Using incorrect <code>Match</code> patterns in filters — patterns must match the tag exactly or use wildcards like <code>kube.*</code>.
  • Omitting the parsers file path in the SERVICE section when using custom parsers in INPUT sections.

Security Notes

  • Enable TLS for all outputs that forward logs over networks — configure <code>Tls On</code>, <code>Tls.verify On</code>, and provide CA certificates.
  • Use <code>HTTP_User</code> and <code>HTTP_Passwd</code> for basic authentication on the built-in HTTP server.
  • Restrict the HTTP server to listen on <code>127.0.0.1</code> instead of <code>0.0.0.0</code> to prevent external access to metrics.
  • Run Fluent Bit as a non-root user with minimal permissions — use <code>Set_Daemon Off</code> for debugging only.
  • Rotate log files and configure retention policies to prevent disk exhaustion attacks.

Production Tips

  • Deploy Fluent Bit as a Kubernetes DaemonSet with resource limits (CPU: 100m, Memory: 128Mi) for predictable performance.
  • Use <code>docker</code> filter with <code>Docker_Mode On</code> to automatically parse multi-line Docker logs into single records.
  • Configure <code>storage.type filesystem</code> in the SERVICE section for disk-backed buffering, enabling survival across restarts.
  • Monitor Fluent Bit metrics via the Prometheus endpoint at <code>/api/v1/metrics/prometheus</code> for throughput, errors, and buffer usage.
  • Use <code>Tag</code> patterns with wildcards (<code>kube.*</code>, <code>var.log.*</code>) to efficiently route logs through filter and output chains.
  • Set <code>storage.backlog.mem_limit</code> to control memory usage for backlog chunks when outputs are temporarily unavailable.

Frequently Asked Questions

What is Fluent Bit?
Fluent Bit is an open-source, lightweight log processor and forwarder written in C. It is part of the Fluentd ecosystem (CNCF graduated project) and is designed for high-performance log collection with minimal resource usage (~1MB memory). It supports 80+ input, filter, and output plugins.
What is the difference between Fluent Bit and Fluentd?
Fluent Bit is a lightweight log collector (~1MB memory) designed for edge collection, while Fluentd is a full-featured data collector (~150MB memory) designed for advanced routing and aggregation. Fluent Bit is ideal for DaemonSets and resource-constrained environments. Many production setups use Fluent Bit forwarding to Fluentd for processing.
What configuration format does Fluent Bit use?
Fluent Bit uses an INI-style configuration file (fluent-bit.conf) with sections: [SERVICE] for global settings, [INPUT] for data sources, [FILTER] for processing, [OUTPUT] for destinations, and [PARSER] for custom log parsing rules. It also supports YAML format.
How do I deploy Fluent Bit on Kubernetes?
Deploy Fluent Bit as a DaemonSet so it runs on every node. Mount /var/log/containers and /var/lib/docker/containers as hostPath volumes. Use the kubernetes filter to enrich logs with pod metadata. Forward output to Elasticsearch, Loki, or a Fluentd aggregator.
What are the key performance tuning parameters?
Key parameters include: Flush interval (SERVICE section), Mem_Buf_Limit (INPUT sections), storage.backlog.mem_limit, and output Buffer_Size. For high-throughput environments, increase Mem_Buf_Limit to 32-64MB, set Flush to 1-5 seconds, and configure disk-backed buffering with storage.type filesystem.
How do I troubleshoot Fluent Bit log loss?
Enable the HTTP server and check Prometheus metrics for buffer overflow and dropped records. Verify Mem_Buf_Limit is sufficient. Check output Retry_Limit and network connectivity. Enable storage.type filesystem for disk-backed buffering. Review Fluent Bit logs for errors and warnings.

How We Keep Your Configs Safe & Valid

Built-in Error Checking

Every file is checked against official rules. We catch missing fields and bad syntax. YAML indentation errors are flagged right away. Kubernetes, Terraform, and Docker specs are all covered. API versions and labels are verified too. You get valid output every time you generate.

100% Private & Local

All tools run in your browser only. Your API keys never leave your machine. We do not use any tracking scripts. No data is sent to any server. Passwords and secrets stay on your device. Crypto operations use the Web Crypto API. Your privacy is fully protected at all times.

Secure Settings by Default

Configs use safe defaults out of the box. Containers run as non-root users. Root filesystems are set to read-only. Dangerous Linux capabilities are dropped. Network policies limit pod-to-pod traffic. TLS 1.3 is enabled for web servers. Security headers are added where needed.

Ready for CI/CD & Git

Output files are ready for your Git repo. Use them with ArgoCD, Flux, or GitHub Actions. Files use clear formatting and comments. Code review is easy for your team. Indentation and key order are consistent. Test in staging before going to production. Every file is clean and well-structured.

Infrastructure as Code

Store configs in Git alongside your code. Terraform modules include typed variables. Backend configs support remote state locking. Outputs work across multiple modules. Ansible playbooks use clear task steps. Chef and Puppet configs are also supported. Every file works with version control tools.

Monitoring & Tracing

Set up Prometheus with auto-discovery rules. Create Grafana dashboards with template variables. Add alerting rules with severity labels. Use OpenTelemetry for trace collection. Forward logs to Loki or Elasticsearch. Connect to Jaeger or Tempo for tracing. Monitor metrics, logs, and traces together.

Container & Docker Safety

Dockerfiles use multi-stage builds for small images. Base images are pinned to exact versions. Dev files are excluded from final images. Health checks are added for orchestrator use. Containers switch to non-root users. Docker Compose uses named volumes and networks. Resource limits are set in deploy configs.

Multiple Output Formats

Export as YAML, JSON, HCL, or TOML. Kubernetes uses YAML with proper separators. Terraform uses HCL with correct escaping. JSON output has consistent indentation. Copy to clipboard with one click. Preview output with syntax highlighting. Line numbers help you review quickly.

Related Tools

Fluentd Config Generator

Generate Fluentd .conf files with sources, outputs, filters, and buffering.

Logstash Config Generator

Create Logstash pipelines with Beats, Kafka, and rich filtering.

Vector Config Generator

Generate ultra-fast Vector pipelines with remap and transform.