Fluentd vs Fluent Bit vs OpenTelemetry Collector — Which Log Forwarder Should You Use?

You need to collect logs from your Kubernetes pods and ship them to your backend (Loki, Elasticsearch, Datadog, S3). Three agents dominate this space: Fluentd, Fluent Bit, and the OpenTelemetry Collector. Here's how to choose.

What Each One Does

Fluentd — The original, battle-tested log aggregator. Ruby-based. Massive plugin ecosystem (500+ plugins). Can do heavy transformation, routing, and multi-destination output.

Fluent Bit — A lightweight C-based forwarder, originally built as the "edge" companion to Fluentd. Much lower resource usage. Fewer plugins, but covers 95% of use cases.

OpenTelemetry Collector — Not just for logs. Collects metrics, traces, AND logs. Vendor-neutral. The CNCF-backed standard for all telemetry data.

Resource Usage Comparison

This matters a lot when running as a DaemonSet on every node:

Fluent Bit is the clear winner on resources. Running Fluentd as a DaemonSet on 50 nodes costs you ~10–20 GB RAM just for the logging agent. Fluent Bit costs ~1–2 GB.

Feature Comparison

Fluentd — When to Use It

Use Fluentd if:

• You need complex log routing logic (route by namespace, by label, by content)
• You need specific transformations unavailable in Fluent Bit
• You're shipping to unusual destinations with no Fluent Bit plugin
• Resource cost is acceptable (larger nodes, fewer pods)

Typical Fluentd config (Kubernetes):

<source>
  @type tail
  path /var/log/containers/*.log
  pos_file /var/log/fluentd-containers.log.pos
  tag kubernetes.*
  read_from_head true
  <parse>
    @type json
    time_format %Y-%m-%dT%H:%M:%S.%NZ
  </parse>
</source>
 
<filter kubernetes.**>
  @type kubernetes_metadata
</filter>
 
<match kubernetes.**>
  @type elasticsearch
  host elasticsearch-master
  port 9200
  index_name fluentd-${tag}-%Y.%m.%d
  <buffer>
    timekey 1d
    timekey_use_utc true
    timekey_wait 10m
  </buffer>
</match>

Fluent Bit — When to Use It

Use Fluent Bit if:

• You're running on Kubernetes and resource efficiency matters
• You need fast log collection with minimal overhead
• You're shipping to Loki, Elasticsearch, Datadog, CloudWatch, or S3
• You want simple config with good defaults

This is the default choice for most Kubernetes setups in 2026.

Fluent Bit DaemonSet config:

# values.yaml for fluent-bit helm chart
config:
  inputs: |
    [INPUT]
        Name tail
        Path /var/log/containers/*.log
        multiline.parser docker, cri
        Tag kube.*
        Mem_Buf_Limit 5MB
        Skip_Long_Lines On
 
  filters: |
    [FILTER]
        Name kubernetes
        Match kube.*
        Merge_Log On
        Keep_Log Off
        K8S-Logging.Parser On
        K8S-Logging.Exclude On
 
  outputs: |
    [OUTPUT]
        Name loki
        Match kube.*
        Host loki-gateway
        Port 80
        Labels job=fluentbit, namespace=$kubernetes['namespace_name']
        Auto_Kubernetes_Labels On

helm repo add fluent https://fluent.github.io/helm-charts
helm install fluent-bit fluent/fluent-bit -f values.yaml -n monitoring

OpenTelemetry Collector — When to Use It

Use OTel Collector if:

• You want ONE agent for logs + metrics + traces
• You're building a vendor-neutral observability stack
• You're using OTLP as your telemetry protocol
• You want to future-proof your observability pipeline

OTel Collector config (logs + metrics to Grafana stack):

receivers:
  filelog:
    include: [/var/log/containers/*.log]
    include_file_path: true
    operators:
      - type: json_parser
        timestamp:
          parse_from: attributes.time
          layout: '%Y-%m-%dT%H:%M:%S.%LZ'
 
  kubeletstats:
    collection_interval: 20s
    auth_type: serviceAccount
    endpoint: "${env:K8S_NODE_NAME}:10250"
 
processors:
  batch:
    timeout: 1s
  memory_limiter:
    check_interval: 1s
    limit_mib: 400
  k8sattributes:
    passthrough: false
 
exporters:
  loki:
    endpoint: http://loki-gateway/loki/api/v1/push
  prometheusremotewrite:
    endpoint: http://prometheus:9090/api/v1/write
 
service:
  pipelines:
    logs:
      receivers: [filelog]
      processors: [memory_limiter, k8sattributes, batch]
      exporters: [loki]
    metrics:
      receivers: [kubeletstats]
      processors: [memory_limiter, batch]
      exporters: [prometheusremotewrite]

The Recommended Setup for 2026

Small to medium clusters (up to 50 nodes): → Fluent Bit as DaemonSet. Simple, light, works great with Loki/ELK/Datadog.

Large clusters or complex routing needs: → Fluent Bit (collection) → Fluentd (aggregation and routing). The classic combo.

Unified observability stack: → OTel Collector. More config, but you get logs + metrics + traces in one agent.

If you're on AWS: → AWS Distro for OpenTelemetry (ADOT) — pre-configured OTel Collector that integrates with CloudWatch and X-Ray.

The log forwarding space is consolidating around OpenTelemetry, but Fluent Bit remains the most deployed Kubernetes logging agent because of its simplicity and low footprint.

For observability hands-on labs including Loki, Prometheus, and Grafana setup, KodeKloud has courses that walk through these exact stacks.