Fluent Bit

Prod Only

Fluent Bit is not deployed in the dev environment. It runs in production only, where it ships container logs to VictoriaLogs. In dev, use kubectl logs to access container output directly.

Fluent Bit is the log collection agent that ships container logs from every node in the cluster to VictoriaLogs. It runs as a DaemonSet — one pod per node — and processes logs automatically with no per-service configuration needed.

---

Connection Details

Property	Value
Kind	DaemonSet (one pod per node)
Namespace	monitoring
Metrics port	2020
Chart	Fluent Bit v0.57.2
ArgoCD sync wave	4 (after VictoriaLogs)
Output	VictoriaLogs at victoria-logs.monitoring.svc.cluster.local:9428

---

How Logs Flow

Your app writes to stdout/stderr
        |
        v
containerd writes to /var/log/containers/*.log
        |
        v
Fluent Bit (DaemonSet) tails the log files
        |
        v
Kubernetes metadata enriched (namespace, pod, container name)
        |
        v
JSON parsing extracts structured fields from message
        |
        v
VictoriaLogs receives and indexes the enriched record

к сведению

This happens automatically for every container. You do not need to configure anything — just write to stdout.

---

What Fluent Bit Does

1. Tails container log files from /var/log/containers/*.log
2. Parses CRI/containerd log format
3. Enriches with Kubernetes metadata (namespace, pod name, container name) via the K8s API
4. Extracts structured JSON from the message field (if your app logs JSON)
5. Ships to VictoriaLogs via HTTP as JSON lines

Key settings

Setting	Value
Input refresh interval	10 seconds
Memory buffer limit	5 MB per input
Skip long lines	Yes
Retry limit	3
Output format	json_lines

---

Debugging

Check DaemonSet status

kubectl get ds -n monitoring -l app.kubernetes.io/name=fluent-bit

View Fluent Bit logs

kubectl logs -n monitoring -l app.kubernetes.io/name=fluent-bit --tail=50

Verify logs reach VictoriaLogs

Open the prod VictoriaLogs UI at /select/vmui and run * — if results appear, the pipeline is working.

Common issues

Symptom	Likely Cause	Fix
No logs in VictoriaLogs	Fluent Bit pod not running or VictoriaLogs down	Check both DaemonSet and VictoriaLogs pod status
Missing namespace metadata	K8s API unreachable from Fluent Bit pod	Check ServiceAccount permissions and network policies
Logs delayed	Memory buffer full	Check Fluent Bit metrics on port 2020

---

What's next: See the Logs Guide for how to query logs in VictoriaLogs.