LoginSign Up
← Back to all sparks
F

Fluent Bit

ANALYTICS
Velocity5.0

Lightweight telemetry and log processor and forwarder

fluentbit.io ↗

Fluent Bit ships parallel version lines with eBPF tracing, GCS/OTLP expansion, and a steady stream of crash fixes.

observabilityebpfkubernetesloggingopentelemetrygcs
◆Current state
Fluent Bit is running three active release branches simultaneously — 4.2.x, 5.0.x, and 5.1.x — with backports keeping the older lines current on security and correctness fixes. The 5.x line is where new capabilities land: eBPF-based tracing (DNS, scheduler, openssl), expanded GCS output (Workload Identity Federation, Parquet compression, Application Default Credentials), and OTLP metrics improvements. Crash fixes across in_tail, in_winevtlog, out_azure_blob, and the Kafka consumer show active hardening of production edge cases.
◆Where it's heading
The eBPF input plugin is building out a full observability surface — DNS, scheduler, openssl traces added over several releases — suggesting a push toward kernel-level telemetry collection as a differentiator from Fluentd and other log shippers. The GCS output expansion (Parquet, WIF, ADC) follows the same pattern: depth-first feature addition to a specific destination rather than broad new connectors. The multiline JSON parser, namespace-scoped systemd capture, and Kubernetes namespace exclusion filter all point toward tighter Kubernetes-native operation.
◆Prediction
The next move is likely more eBPF trace types (HTTP, TCP) completing the network observability set, and broader OTLP coverage given OpenTelemetry's growing dominance as the wire format in observability stacks.

◆Recent moves

  1. 11d ago

    Fluent Bit 5.1.2: GCS Parquet compression, WIF support, namespace filtering

    5.1.2 is the largest 5.1.x drop so far, adding Parquet compression and Workload Identity Federation to the GCS output, namespace-scoped systemd capture, Kubernetes namespace exclusion in the filter, and a built-in JSON multiline parser — extending the 5.x capability surface across cloud storage and Kubernetes-native use cases. The macOS stat and thermal metrics rounding out the node exporter fit the same pattern of closing platform gaps rather than introducing new directions.

    View source ↗
  2. 12d ago

    Fluent Bit 5.0.10: maintenance backports

    5.0.10 is a backport-only release, cherry-picking TLS retry, Windows event log enrichment, Avro/Kafka, and a batch of maintenance fixes from 5.1 onto the stable 5.0 branch. No net-new capability — this is the stable channel getting the fixes that landed in 5.1 upstream.

    View source ↗
  3. 1mo ago

    Fluent Bit 5.1.1: storage chunk size validation fix

    5.1.1 is a single-fix release addressing a test-side storage limit validation bug in the 5.1 line. Purely internal; no user-visible change.

    View source ↗
  4. 1mo ago

    Fluent Bit 5.1.0: eBPF DNS/scheduler/openssl traces, OTLP metrics, Chronicle updates

    5.1.0 opened the new minor with three new eBPF trace types (DNS, scheduler, openssl) and expanded the Chronicle output with label and namespace mapping — deepening the kernel-level telemetry capability that became a 5.x theme. The eBPF additions mark a consistent architectural bet on kernel-native data collection rather than agent-side instrumentation.

    View source ↗
  5. 1mo ago

    Fluent Bit 4.2.8: Windows event enrichment and Avro/Kafka backports

    4.2.8 backports three targeted fixes — Windows event log enrichment, Stackdriver payload safety, and Avro/Kafka empty map handling — to the 4.2 stable line. No new capability; pure maintenance for users who haven't moved to 5.x.

    View source ↗
  6. 2mo ago

    Fluent Bit 4.2.7: librdkafka upgrade and forward protocol fixes

    4.2.7 upgrades librdkafka to v2.15.0 and patches several in_forward and out_forward protocol edge cases on the 4.2 branch, alongside a gzip endian-safety fix and a CPU-hang on connection teardown. All backports; the 5.x line already carries these.

    View source ↗