Fluent Bit

Ship files, Windows Event Logs and container logs to XPLG with Fluent Bit: the HTTP/S listener output (recommended), the syslog output over UDP or TCP, and the host and cluster set-ups.

What you will do: install Fluent Bit where the data is produced and point its output at an XPLG listener.

Fluent Bit is the shipper XPLG recommends: open source, light, multi-platform, with inputs for files, Windows Event Logs and containers. XPLG receives it on a built-in listener; there is no XPLG agent to install on the source. Two outputs work:

Output	XPLG listener	When
`http` (recommended)	HTTP/S listener with a token, port 30303 or 30443	Everything: structured JSON, TLS, keep-alive, retries, the hostname carried in the URL
`syslog`	Syslog listener, UDP 514 (events up to 1,024 bytes) or TCP 1468 (up to 8,192 bytes)	Sites that only allow syslog, or devices that already speak it

1. Create the listener in XPLG

PortX > Data > Listeners: add an HTTP/S listener and copy its endpoint and token. The URL has the form https://<xplg-host>:30443/logeye/api/logger.jsp?token=<token>&hostName=<source>; HTTPS is recommended and the token is the authentication. For syslog, add a UDP or TCP listener instead and note its port. Make sure the source hosts can reach the listener address.

2. Linux host

Install the package from the Fluent Bit repository for your distribution (for example sudo yum install fluent-bit or sudo apt install fluent-bit).
Replace /etc/fluent-bit/fluent-bit.conf with a tail input for your files and the HTTP output:

[SERVICE]
    Flush        5
    storage.path /var/lib/fluent-bit/storage

[INPUT]
    Name          tail
    Path          /var/log/app/*.log
    Tag           app
    Refresh_Interval 10
    storage.type  filesystem

[OUTPUT]
    Name   http
    Match  *
    Host   <xplg-host>
    Port   30443
    URI    /logeye/api/logger.jsp?token=<token>&hostName=${HOSTNAME}
    Format json
    header_tag message
    tls    On
    Retry_Limit 10
    net.keepalive On
    net.keepalive_idle_timeout 30

sudo systemctl enable --now fluent-bit, then check the listener's folder in Folders and Logs: data appears within one to two minutes.

3. Windows host

Download fluent-bit-<version>-win64.zip from the Fluent Bit site, extract it to C:\fluent-bit\.
Write C:\fluent-bit\conf\fluent-bit.conf with two inputs — Windows Event Logs and a tail for custom files — and the same HTTP output:

[INPUT]
    Name         winlog
    Channels     Application,System,Security
    Interval_Sec 1
    DB           C:\fluent-bit\winlog.sqlite

[INPUT]
    Name   tail
    Path   C:\app\logs\*.log
    Tag    app

[OUTPUT]
    Name   http
    Match  *
    Host   <xplg-host>
    Port   30443
    URI    /logeye/api/logger.jsp?token=<token>&hostName=${COMPUTERNAME}
    Format json
    header_tag message
    tls    On

sc create fluent-bit binpath= "C:\fluent-bit\bin\fluent-bit.exe -c C:\fluent-bit\conf\fluent-bit.conf" start= auto
sc description fluent-bit "fluent-bit log shipper to XPLG"
sc start fluent-bit

Direct collection of Windows Events by a Windows XPLG node remains available as a pull source; see Windows Server.

4. Syslog output (UDP or TCP)

When HTTP is not an option, send to the syslog listener. Use TCP for lines above 1,024 bytes.

[OUTPUT]
    Name                 syslog
    Match                *
    Host                 <xplg-host>
    Port                 1468
    Mode                 tcp
    Syslog_Format        rfc5424
    Syslog_Hostname_key  hostname
    Syslog_Message_key   log

Set Mode udp and Port 514 for the UDP listener. In XPLG, split the listener by source device so each sender becomes its own log.

5. Kubernetes, OpenShift, EKS, Tanzu

Run Fluent Bit as a DaemonSet (Helm chart fluent/fluent-bit, read-only RBAC on pods and namespaces, filesystem buffering) or as a sidecar, with the same HTTP output. The values, the RBAC and the EKS, Tanzu and OpenShift notes are on Kubernetes and OpenShift.

Checks

Nothing arrives: the token or port is wrong, TLS is on but the port is 30303, or a firewall blocks the host; test with curl -k -X POST "https://<xplg-host>:30443/logeye/api/logger.jsp?token=<token>&hostName=test" -H "Content-Type: application/json" -d "{\"message\":\"hello\"}".
Events arrive unparsed: set the listener's Message JSON Key or JSON Parsing Level, or let the AI pattern parser learn the format.
Duplicates after a restart: keep Fluent Bit's tail database (DB) on persistent storage.

Next: API

Source: XPLG wiki, pages 1919418369, 1595637847, 2399535175, 2401075202, 3151659026, 1594131765 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1919418369).

Search documentation