Skip to content

Coralogix Fluent Bit Helm chart migration to the official Fluent Bit Helm chart

This guide explains how to migrate from the Coralogix custom Fluent Bit Helm chart to the official Fluent Bit Helm chart while continuing to send logs to Coralogix.

The Coralogix Fluent Bit Helm chart continues to work but will not be supported anymore. Migrating to the official Fluent Bit Helm chart is optional, but recommended to simplify upgrades and align with upstream Fluent Bit releases.

Why migrate to the official Fluent Bit Helm chart?

The official Fluent Bit Helm chart is maintained by the Fluent Bit project and provides:

  • Faster access to upstream Fluent Bit releases
  • Closer alignment with official Fluent Bit documentation
  • Reduced chart-specific customization
  • Easier long-term maintenance

The Coralogix Helm chart includes additional defaults and abstractions. Migrating removes this layer while preserving log ingestion into Coralogix.

What stays the same

This migration does not change how logs are ingested into Coralogix.

The following remain unchanged:

  • Fluent Bit as the log collector
  • Coralogix ingestion endpoints
  • Authentication using your Coralogix private key
  • Log structure, metadata, and parsing behavior
  • Existing dashboards, alerts, and pipelines

No changes are required in the Coralogix UI.

What changes

AreaCoralogix Helm chartOfficial Fluent Bit Helm chart
Chart ownershipCoralogixFluent Bit project
Configuration styleCoralogix abstractionsNative Fluent Bit values
Upgrade cadenceCoralogix-managedUpstream Fluent Bit
DefaultsOpinionatedMinimal

You will need to explicitly configure outputs, filters, and parsers that were previously pre-configured by the Coralogix chart.

Migration overview

At a high level, the migration includes:

  1. Installing the official Fluent Bit Helm chart
  2. Translating Coralogix-specific values to native Fluent Bit configuration
  3. Validating log ingestion
  4. Removing the Coralogix Helm chart

You can run both charts side by side during migration.

Step 1: Add official Fluent Bit Helm repository

Add the Fluent Bit Helm repository:

helm repo add fluent <https://fluent.github.io/helm-charts>
helm repo update

Step 2: Create Namespace

kubectl create namespace fluent-bit

Step 3: Create Coralogix secret

Create the secret containing your Coralogix private Send-Your-Data key:

kubectl create secret generic coralogix-keys \
  --from-literal=PRIVATE_KEY=your-coralogix-private-key \
  --namespace=fluent-bit

Replace:

  • <PRIVATE_KEY> with your Coralogix private key

Step 4: Create Lua Script ConfigMap

Create the ConfigMap containing the Lua script for metadata processing:

kubectl create configmap fluent-bit-http-crxluascript -n fluent-bit --from-literal=script.lua="RETURN_WITHOUT_MODIFYING_TIMESTAMP = 2
function addcrxmetadata(tag, timestamp, record)
  new_record = record
  new_record[\"applicationName\"] = record.json.kubernetes.namespace_name
  if new_record[\"applicationName\"] == nil then
  new_record[\"applicationName\"] = \"no-application\" end
  new_record[\"subsystemName\"] = record.json.kubernetes.container_name
  if new_record[\"subsystemName\"] == nil then
  new_record[\"subsystemName\"] = \"no-subsystem\" end
  local processed_fraction = string.format(\"%09d\", timestamp['nsec'])
  new_record[\"timestamp\"] = string.format(\"%s%s\", timestamp['sec'], string.sub(processed_fraction, 1, -4))
  return RETURN_WITHOUT_MODIFYING_TIMESTAMP, timestamp, new_record
end"

Step 5: Install Fluent Bit with override values

Install the official Fluent Bit chart using the provided override-values.yaml below:

helm install fluent-bit-http fluent/fluent-bit \
  --namespace=fluent-bit \
  --values ./override-values.yaml \
  --set endpoint=ingress.eu1.coralogix.com

override-values.yaml

# This file replaces the need for the custom Coralogix chart by using the official chart with overrides
# Image configuration - using official Fluent Bit same version as Coralogix 
Image:
  repository: fluent/fluent-bit
  tag: "3.2.10"
  pullPolicy: IfNotPresent

# Command and args configuration 
command:
  - /fluent-bit/bin/fluent-bit

args:
  - --workdir=/fluent-bit/etc
  - --config=/fluent-bit/etc/conf/fluent-bit.conf

# Resource configuration 
resources:
  limits:
    cpu: 100m
    memory: 250Mi
  requests:
    cpu: 100m
    memory: 250Mi

# Node
tolerations:
  - operator: Exists

# Network configuration 
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet

# RBAC configuration
rbac:
  nodeAccess: true

# Service monitor configuration
serviceMonitor:
  enabled: false
  additionalEndpoints:
    - port: storage-metrics
      path: /metrics

# Extra ports for metrics
extraPorts:
  - port: 2021
    containerPort: 2021
    protocol: TCP
    name: storage-metrics

# Environment variables 
env:
  - name: APP_NAME_SYSTEMD
    value: systemd
  - name: SUB_SYSTEM_SYSTEMD
    value: kubelet
  - name: HOSTNAME
    valueFrom:
      fieldRef:
        apiVersion: v1
        fieldPath: metadata.name

# Environment variables from secrets
envFrom:
  - secretRef:
      name: coralogix-keys

# Template-based environment variables 
envWithTpl:
  - name: ENDPOINT
    value: "{{ .Values.endpoint }}"
  - name: LOG_LEVEL
    value: "{{ .Values.logLevel }}"

# Fluent Bit configuration 
config:
  service: |
    [SERVICE]
        Daemon Off
        Flush 1
        Log_Level {{ .Values.logLevel }}
        Parsers_File /fluent-bit/etc/parsers.conf
        Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
        HTTP_Server On
        HTTP_Listen 0.0.0.0
        HTTP_Port 2020
        Health_Check On

  inputs: |
    [INPUT]
        Name fluentbit_metrics
        Tag metrics
        Scrape_Interval 5
        Scrape_On_Start On

    [INPUT]
        Name tail
        Tag kube.*
        Path /var/log/containers/*.log
        multiline.parser docker, cri
        Refresh_Interval 5
        Skip_Long_Lines On
        Mem_Buf_Limit 25MB
        DB /var/log/fluentbit-tail.db

    [INPUT]
        Name systemd
        Tag host.*
        Systemd_Filter _SYSTEMD_UNIT=kubelet.service
        Read_From_Tail On
        Mem_Buf_Limit 5MB

  filters: |
    [FILTER]
        Name kubernetes
        Match kube.*
        K8S-Logging.Parser On
        K8S-Logging.Exclude On
        Use_Kubelet On
        Annotations Off
        Labels On
        Buffer_Size 100MB
        Keep_Log Off
        Merge_Log_Key log_obj
        Merge_Log On
        tls.verify Off

    [FILTER]
        Name nest
        Match kube.*
        Operation nest
        Wildcard *
        Nest_Under json

    [FILTER]
        Name lua
        Match kube.*
        Script /fluent-bit/scripts/script.lua
        Call addcrxmetadata
        time_as_table true

    [FILTER]
        Name modify
        Match host.*
        Add applicationName systemd
        Copy kubelet subsystemName

    [FILTER]
        Name nest
        Match host.*
        Operation nest
        Wildcard _HOSTNAME
        Wildcard SYSLOG_IDENTIFIER
        Wildcard _CMDLINE
        Wildcard MESSAGE
        Nest_Under json

  outputs: |
    [OUTPUT]
        Name prometheus_exporter
        Match metrics
        Host 0.0.0.0
        Port 2021

    [OUTPUT]
        Name http
        Match_regex ^(kube\..*|host\..*)$
        Host {{ .Values.endpoint }}
        Port 443
        URI /logs/v1/singles
        Format json_lines
        tls On
        Header Authorization Bearer ${PRIVATE_KEY}
        Compress gzip
        Retry_Limit False
        net.keepalive Off

# Extra volumes for Lua script
extraVolumes:
  - name: crxluascript
    configMap:
      name: fluent-bit-http-crxluascript

# Extra volume mounts
extraVolumeMounts:
  - name: crxluascript
    mountPath: /fluent-bit/scripts/script.lua
    subPath: script.lua

# PrometheusRule configuration (commented out by default)
# prometheusRule:
#   enabled: true
#   rules:
#   - alert: FluentbitNoOutputBytesProcessed
#     expr: rate(fluentbit_output_proc_bytes_total[5m]) == 0
#     annotations:
#       description: |
#         "FluentBit instance {{$labels.instance}}'s output plugin {{$labels.name}} has not processed any
#         bytes for at least 15 minutes."
#       summary: No Output Bytes Processed
#     for: 2m
#     labels:
#       severity: critical
#   - alert: FluentbitErrorRateIncreased
#     expr: sum(rate(fluentbit_output_retries_failed_total[5m])) > 0
#     annotations:
#       description: |
#         "FluentBit experiencing connectivity issues with Coralogix, issue may cause missing data for Coralogix"
#       summary: Retries failed#     for: 2m#     labels:#       severity: critical#   - alert: FluentbitNoInput
#     expr: sum by (pod) (rate(fluentbit_input_bytes_total[5m])) == 0
#     annotations:
#       description: |
#         "FluentBit is having 0 data incoming, restart the pod  {{$labels.pod}}"
#       summary: FluentBit no input coming
#     for: 2m
#     labels:
#       severity: warning

# Default configuration values 
endpoint: ingress.eu1.coralogix.com
logLevel: error

# Dynamic metadata configuration (extract from log fields) 
dynamic_metadata:
  app_name: kubernetes.namespace_name
  sub_system: kubernetes.container_name

# Static metadata configuration (hardcoded values)
static_metadata:
  app_name: ""
  sub_system: ""

Support

Need help?

Our world-class customer success team is available 24/7 to walk you through your setup and answer any questions that may come up.

Feel free to reach out to us via our in-app chat or by sending us an email at support@coralogix.com.