Snippets · Sources

Receive logs from Fluent Bit and Fluentd (forward)

Fluent Bit and Fluentd are on many hosts already. Their forward output can point at a collector, and the fluentforward receiver turns each record into an OpenTelemetry log record - a way to migrate the backend before migrating the agents.

OpenTelemetry Collector

OpenTelemetry Collector YAML

receivers:
  fluentforward:
    endpoint: 0.0.0.0:24224

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  batch:
    timeout: 5s

exporters:
  otlphttp:
    endpoint: https://your-backend:4318

service:
  pipelines:
    logs:
      receivers: [fluentforward]
      processors: [memory_limiter, batch]
      exporters: [otlphttp]

LinkMesh

Library › Sources › Fluent Forward

Listen Address: 0.0.0.0:24224

What LinkMesh then pushes to the collector, under receivers:

Pushed to the collector

fluentforward/input_src_00000501:
  endpoint: 0.0.0.0:24224

The same, as an API call (see automation recipes):

API call

curl -X POST "$LINKMESH/sources" \
  -H "Authorization: Bearer $LMSAT" \
  -H "Content-Type: application/json" \
  -d '{
  "defaultConfig": {
    "endpoint": "0.0.0.0:24224"
  },
  "name": "Fluent Forward",
  "receiverType": "fluentforward"
}'

The rest of the collector config above (memory_limiter, batch, otlphttp) is not part of this template: in LinkMesh those are separate sources, processors and destinations on the route.

Generated from LinkMesh's template catalogue by linkmesh-server snippet-render 1.464.3, not written by hand.

Download config.yamlValidated with otelcol-contrib v0.161.0 on 2026-10-26

Complete config files, each checked with the collector's own validate command (otelcol-contrib v0.161.0). Replace https://your-backend:4318 with your own OTLP endpoint before you run it.

The gotcha

The record fields arrive as attributes, and the body is empty. In our test a Fluent Bit record {"msg": "order 1002 accepted", "level": "info"} arrived with msg, level and fluent.tag (app.checkout) as attributes and no body at all, so a log view that shows the body shows blank lines. If your backend needs a body, move the message there, for example with a transform statement set(body, attributes["msg"]).

Manage this across a fleet

LinkMesh manages collector configuration across a fleet from one self-hosted control plane, so a change like this is made once rather than host by host. The first 25 Collectors are free after a no-card registration in the OpenSight Customer Portal (5 without one).

Doing this in LinkMesh: Sources

Install LinkMesh →See all snippets

Receive logs from Fluent Bit and Fluentd (forward)

OpenTelemetry Collector

LinkMesh

The gotcha

Manage this across a fleet

Related snippets