Forward logs from Fluent Bit to Osuite

Overview

If you already run Fluent Bit, you can route its output to Osuite instead of adding a second agent. Fluent Bit ships an OpenTelemetry output that speaks OTLP directly, and a Forward output that hands records to an OpenTelemetry Collector. Both paths end at the same otlp/osuite destination.

Prerequisites

• A running Fluent Bit instance with inputs already configured.
• Your Osuite ingest endpoint and token.
• For the Collector path, an OpenTelemetry Collector reachable from Fluent Bit.

Send directly with the OpenTelemetry output

Fluent Bit’s opentelemetry output posts logs over OTLP/HTTP and supports custom headers, so it can carry the Osuite ingest token to the ingest endpoint.

[OUTPUT]
    Name          opentelemetry
    Match         *
    Host          ingest.<region>.osuite.io
    Port          443
    Logs_uri      /v1/logs
    Tls           On
    Tls.verify    On
    Header        x-osuite-ingest-token <your-ingest-token>

This is the fewest moving parts: no Collector to run. Records go straight to Osuite as OTLP log records.

Send through a Collector with the Forward output

Run this path when you want a Collector in the middle to batch, enrich, or redact centrally before export. Fluent Bit forwards over the Fluent Forward protocol to the Collector’s fluent_forward receiver.

Fluent Bit:

[OUTPUT]
    Name    forward
    Match   *
    Host    <your-collector-host>
    Port    8006

Collector:

receivers:
  fluent_forward:
    endpoint: 0.0.0.0:8006

processors:
  batch:

exporters:
  otlp/osuite:
    endpoint: ingest.<region>.osuite.io:443
    tls:
      insecure: false
    headers:
      x-osuite-ingest-token: <your-ingest-token>

service:
  pipelines:
    logs:
      receivers: [fluent_forward]
      processors: [batch]
      exporters: [otlp/osuite]

The fluent_forward receiver maps each Fluent Bit record to a log record: the Fluent tag becomes the fluent.tag attribute, the message populates the body, and the remaining fields become attributes.

Tip

Use the OpenTelemetry output for the simplest setup; use the Forward output when a shared Collector already handles batching, enrichment, and redaction for other sources.

Verify in Osuite

What you should see

Fluent Bit records appear in the Logs Explorer within a minute. On the Forward path they carry the fluent.tag attribute, so filtering by tag isolates a given input.

Troubleshooting

On the direct path, a 404 means the x-osuite-ingest-token header is missing or wrong — ingest matches the token at the edge, so an unrecognised token fails route matching instead of returning 401 or 403 — and a TLS error means Tls is not On. On the Forward path, confirm Fluent Bit reaches the Collector on port 8006 and that the fluent_forward receiver is wired into the logs pipeline. Enable Log_response_payload On on the OpenTelemetry output to see the ingest response.

No data in Osuite after a few minutes? Work through these checks.

• Endpoint — confirm the exporter targets exactly ingest.<region>.osuite.io:443 for your region, over TLS.
• Token — confirm the ingest header carries a valid <your-ingest-token> and has not been rotated.
• Pipeline — confirm the signal you expect (traces, logs, or metrics) is wired into an active pipeline with the otlp/osuite exporter attached.
• Export errors — check the application or Collector logs for OTLP export failures (auth, DNS, TLS, connection refused).
• Network — confirm the host has outbound access to the ingest endpoint on port 443.
• Timing — allow up to a minute for the first data to appear before assuming a failure.

Still stuck? Ask the Investigation Agent or contact support.

Next steps

• Collect logs from any source — other sources and forwarders.
• Log pipelines — redact, filter, and route logs before storage.