Fluent Bit

Overview

Configure Fluent Bit to collect, parse, and forward log data from several different sources to Datadog for monitoring. Fluent Bit has a small memory footprint (~450 KB), so you can use it to collect logs in environments with limited resources, such as containerized services and embedded Linux systems. Datadog’s Fluent Bit output plugin supports Fluent Bit v1.3.0+.

Setup

Find below instructions to configure Fluent Bit on a host, for Amazon ECS, see ECS Fluent Bit and FireLens.

Log collection

Before you begin, you need to have a Datadog account, a Datadog API key, and you need to activate Datadog Logs Management.

Install and configure Fluent Bit by using their recommended method of a configuration file.
Update your Fluent Bit configuration file to add Datadog as an output plugin. For more information on the configuration parameters, see the Configuration parameters table. For an example [OUTPUT] configuration section, see the Configuration file example.
Once you start sending logs from Fluent Bit, verify the logs on the Datadog Logs Explorer page.

Configuration parameters

Key	Description	Default
Host	Required - The Datadog server where you are sending your logs.
TLS	Required - End-to-end security communications security protocol. This setting must be set to `on`.	`off`
apikey	Required - Your Datadog API key.
compress	Recommended - compresses the payload in GZIP format, Datadog supports and recommends setting this to `gzip`.
dd_service	Recommended - The human readable name for your service generating the logs - the name of your application or database.
dd_source	Recommended - A human readable name for the underlying technology of your service. For example, `postgres` or `nginx`.
dd_message_key	Recommended - Set the attribute to use to store your log message.
dd_tags	Optional - The tags you want to assign to your logs in Datadog.
dd_hostname	Optional - The host that emitted logs should be associated with. If unset, Datadog expects the host to be set as one of the standard host attributes.
provider	Optional - The provider to use. Set this to `ecs` if you want to send logs from your Fargate Tasks to Datadog.

Configuration file example

[OUTPUT]
    Name              datadog
    Match             *
    Host              http-intake.logs.datadoghq.com
    TLS               on
    compress          gzip
    apikey            <DATADOG_API_KEY>
    dd_service        <APPLICATION_SERVICE>
    dd_source         <SOURCE>
    dd_message_key    log
    dd_tags           env:dev,<TAG_KEY>:<TAG_VALUE>

Troubleshooting

Need help? Contact Datadog support.