Fluent Bit vs Fluentd vs Vector — Log Collectors for Kubernetes 2026

# Minimal Fluent Bit config for Kubernetes → Loki
apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: logging
data:
  fluent-bit.conf: |
    [SERVICE]
        Flush         1
        Log_Level     info
        Parsers_File  parsers.conf
 
    [INPUT]
        Name              tail
        Tag               kube.*
        Path              /var/log/containers/*.log
        Parser            docker
        DB                /var/log/flb_kube.db
        Mem_Buf_Limit     5MB
        Skip_Long_Lines   On
        Refresh_Interval  10
 
    [FILTER]
        Name                kubernetes
        Match               kube.*
        Kube_URL            https://kubernetes.default.svc:443
        Merge_Log           On
        Keep_Log            Off
        K8S-Logging.Parser  On
 
    [OUTPUT]
        Name            loki
        Match           kube.*
        Host            loki.logging.svc.cluster.local
        Port            3100
        Labels          job=fluentbit, namespace=$kubernetes['namespace_name']
        Auto_kubernetes_labels On

helm repo add fluent https://fluent.github.io/helm-charts
helm install fluent-bit fluent/fluent-bit \
  -n logging --create-namespace \
  -f fluent-bit-values.yaml

# Fluentd config: collect, parse, enrich, route to multiple backends
<source>
  @type tail
  path /var/log/containers/*.log
  tag kubernetes.*
  <parse>
    @type json
    time_format %Y-%m-%dT%H:%M:%S.%NZ
  </parse>
</source>
 
<filter kubernetes.**>
  @type kubernetes_metadata
  watch false
</filter>
 
# Route errors to Elasticsearch, all logs to S3
<match kubernetes.**>
  @type copy
  <store>
    @type elasticsearch
    host elasticsearch.logging.svc.cluster.local
    port 9200
    logstash_format true
    <filter>
      @type grep
      regexp1 message ERROR|WARN
    </filter>
  </store>
  <store>
    @type s3
    s3_bucket my-logs-bucket
    s3_region us-east-1
    path logs/%Y/%m/%d/
    <buffer time>
      timekey 1h
      timekey_wait 10m
    </buffer>
  </store>
</match>

# Vector config: TOML-based, composable
[sources.kubernetes_logs]
type = "kubernetes_logs"
 
[transforms.enrich]
type = "remap"
inputs = ["kubernetes_logs"]
source = '''
  # VRL (Vector Remap Language) — powerful transformation
  .namespace = .kubernetes.pod_namespace
  .pod = .kubernetes.pod_name
  .container = .kubernetes.container_name
  
  # Parse JSON logs if they exist
  if is_string(.message) {
    parsed, err = parse_json(.message)
    if err == null {
      .message = parsed
    }
  }
'''
 
[transforms.filter_noise]
type = "filter"
inputs = ["enrich"]
condition = '!includes(["healthz", "/metrics"], .message.path ?? "")'
 
[sinks.loki]
type = "loki"
inputs = ["filter_noise"]
endpoint = "http://loki.logging.svc.cluster.local:3100"
labels.namespace = "{{ namespace }}"
labels.pod = "{{ pod }}"
 
[sinks.s3_archive]
type = "aws_s3"
inputs = ["filter_noise"]
bucket = "my-logs-archive"
region = "us-east-1"
key_prefix = "logs/{{ namespace }}/{{ now() | strftime(\"%Y/%m/%d\") }}/"
compression = "gzip"