Install Fluent Bit on VPS — Lightweight Log Collector

Published: October 7, 2026

Fluent Bit log collector on VPS Linux

Fluent Bit is an ultra-lightweight log processor and forwarder — using only ~1 MB of RAM at idle compared to Logstash's hundreds of megabytes. Written in C and designed for embedded systems and Kubernetes, it also works excellently on standard VPS environments.

This guide covers installing Fluent Bit on Ubuntu/Debian, configuring it to collect logs from systemd journal and nginx access logs, then forwarding them to Loki or Elasticsearch, with parsers and filters included.

Fluent Bit vs Logstash vs Filebeat

ToolLanguageRAMStrengths
Fluent BitC~1-5 MBLightest, built-in parsers, Lua filters
FilebeatGo~50 MBPart of ELK stack, easy config
LogstashJVM~300-500 MBMost powerful, vast plugin ecosystem
FluentdRuby~40 MBLarge ecosystem, many plugins

Fluent Bit Pipeline Architecture

Fluent Bit works as a pipeline: Input → Parser → Filter → Buffer → Output

Step 1 — Install Fluent Bit

Install from the official Fluent Bit repository:

curl https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh | sh

Or install manually on Ubuntu 22.04:

curl -fsSL https://packages.fluentbit.io/fluentbit.key | sudo gpg --dearmor -o /usr/share/keyrings/fluentbit-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/fluentbit-keyring.gpg] https://packages.fluentbit.io/ubuntu/jammy jammy main" \
  | sudo tee /etc/apt/sources.list.d/fluent-bit.list

sudo apt update
sudo apt install -y fluent-bit

Verify the installation:

fluent-bit --version

Step 2 — Quick Start Test

Run a minimal test — collect CPU metrics and print to stdout:

fluent-bit -i cpu -o stdout -f 1

You should see output like this:

[0] cpu.0: [[1728269100.000000000, {}], {"cpu_p"=>5.5, "user_p"=>3.2, "system_p"=>2.3, ...}]

Step 3 — Main Configuration File

The main config file is at /etc/fluent-bit/fluent-bit.conf:

sudo nano /etc/fluent-bit/fluent-bit.conf
[SERVICE]
    flush         5
    log_level     info
    parsers_file  parsers.conf
    plugins_file  plugins.conf

# --- Inputs ---

# Collect logs from systemd journal
[INPUT]
    name              systemd
    tag               systemd.*
    read_from_tail    on
    strip_underscores on

# Tail nginx access log
[INPUT]
    name              tail
    tag               nginx.access
    path              /var/log/nginx/access.log
    parser            nginx
    refresh_interval  5
    mem_buf_limit     10MB
    skip_long_lines   on

# --- Filters ---

# Add hostname to every record
[FILTER]
    name    record_modifier
    match   *
    record  hostname ${HOSTNAME}

# Filter out healthcheck noise
[FILTER]
    name    grep
    match   nginx.access
    exclude request GET /health

# --- Outputs ---

# Send to stdout (for debugging)
[OUTPUT]
    name   stdout
    match  *

Step 4 — Forward Logs to Loki

Add a Loki output section (replace or add alongside stdout):

[OUTPUT]
    name            loki
    match           *
    host            localhost
    port            3100
    labels          job=fluent-bit,host=${HOSTNAME}
    label_keys      $app,$level
    line_format     json
Note: You need Loki installed first. See Install Loki + Grafana on VPS for setup instructions.

Step 5 — Forward Logs to Elasticsearch

If you're using the ELK stack instead of Loki:

[OUTPUT]
    name            es
    match           *
    host            localhost
    port            9200
    index           fluent-bit
    type            _doc
    logstash_format on
    logstash_prefix fluent-bit
    time_key        @timestamp
    retry_limit     3

Step 6 — Configure an Nginx Parser

Edit /etc/fluent-bit/parsers.conf to add an nginx parser:

[PARSER]
    name        nginx
    format      regex
    regex       ^(?[^ ]*) (?[^ ]*) (?[^ ]*) \[(?

Step 7 — Enable the Service

sudo systemctl enable fluent-bit
sudo systemctl start fluent-bit
sudo systemctl status fluent-bit
Tip: Use fluent-bit -c /etc/fluent-bit/fluent-bit.conf --dry-run to validate your config before restarting the service.

Step 8 — Lua Filter for Complex Transforms

Fluent Bit supports Lua scripts for advanced log transformation:

[FILTER]
    name    lua
    match   nginx.access
    script  /etc/fluent-bit/enrich.lua
    call    enrich_record
-- /etc/fluent-bit/enrich.lua
function enrich_record(tag, timestamp, record)
    -- Categorize HTTP status codes
    local code = tonumber(record["code"])
    if code then
        if code >= 500 then
            record["severity"] = "error"
        elseif code >= 400 then
            record["severity"] = "warning"
        else
            record["severity"] = "info"
        end
    end
    return 1, timestamp, record
end

Verify Fluent Bit Is Working

# Check service status
sudo systemctl status fluent-bit

# View Fluent Bit's own logs
sudo journalctl -u fluent-bit -n 50 --no-pager

# Validate config without restarting
fluent-bit -c /etc/fluent-bit/fluent-bit.conf --dry-run

# View metrics via HTTP (add to [SERVICE]: http_server on, http_port 2020)
curl http://localhost:2020/api/v1/metrics

# View uptime and processed records
curl http://localhost:2020/api/v1/uptime
Tip: Enable http_server on in [SERVICE] to expose Fluent Bit metrics via HTTP — these can be scraped directly by Prometheus.

Troubleshooting Common Issues

Error: "tail plugin: inotify_init() failed"

This occurs when the inotify watch limit is exhausted — increase it:

# Check current limit
cat /proc/sys/fs/inotify/max_user_watches

# Increase temporarily
sudo sysctl fs.inotify.max_user_watches=524288

# Make it permanent
echo "fs.inotify.max_user_watches=524288" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Error: "connection refused" When Sending to Loki/Elasticsearch

Verify the destination service is running and the port is open:

# Check Loki
curl -s http://localhost:3100/ready

# Check Elasticsearch
curl -s http://localhost:9200/_cluster/health

# Check port availability
sudo ss -tlnp | grep -E "3100|9200"

Error: "Permission denied" Reading Log Files

Fluent Bit needs read access to log files — add its user to the appropriate group:

# Add fluent-bit user to adm group (for /var/log access)
sudo usermod -aG adm fluent-bit

# Or run the service as root
sudo systemctl edit fluent-bit --force
# Add:
# [Service]
# User=root

Logs Are Delayed or Coming in Slowly

Reduce the flush interval in [SERVICE] and tune mem_buf_limit:

[SERVICE]
    flush     1      # Reduce from 5 to 1 second

[INPUT]
    name              tail
    mem_buf_limit     5MB
    buffer_chunk_size 512k
    buffer_max_size   5MB

Memory Usage Is Unexpectedly High

Usually caused by output failures filling the buffer — limit retries and use disk-backed storage:

[OUTPUT]
    name          loki
    match         *
    retry_limit   3    # Prevent unbounded queue growth

# Add disk storage for the buffer
[SERVICE]
    storage.path  /var/lib/fluent-bit/
    storage.sync  normal

Frequently Asked Questions

What's the difference between Fluent Bit and Fluentd?

Fluent Bit is a lightweight version of Fluentd — written in C instead of Ruby, making it significantly faster and less resource-intensive. Fluentd has a larger plugin ecosystem and handles more complex routing scenarios. In Kubernetes, a common pattern is to run Fluent Bit as a DaemonSet to collect logs and forward them to a central Fluentd aggregator.

Can I use Fluent Bit with Docker?

Yes — Docker supports Fluent Bit natively as a logging driver. Use --log-driver=fluentd --log-opt fluentd-address=localhost:24224 in your docker run command, or run the fluent/fluent-bit image as a sidecar container in Docker Compose.

Does Fluent Bit support Kubernetes log collection?

Fluent Bit is actually the default log collector for many Kubernetes distributions. Use the built-in kubernetes input plugin to automatically enrich logs with pod and namespace metadata. Deploy it as a DaemonSet to collect logs from every node in the cluster.

Related Articles