Coralogix Fluent Bit Helm chart migration to the official Fluent Bit Helm chart
This guide explains how to migrate from the Coralogix custom Fluent Bit Helm chart to the official Fluent Bit Helm chart while continuing to send logs to Coralogix.
The Coralogix Fluent Bit Helm chart continues to work but will not be supported anymore. Migrating to the official Fluent Bit Helm chart is optional, but recommended to simplify upgrades and align with upstream Fluent Bit releases.
Why migrate to the official Fluent Bit Helm chart?
The official Fluent Bit Helm chart is maintained by the Fluent Bit project and provides:
- Faster access to upstream Fluent Bit releases
- Closer alignment with official Fluent Bit documentation
- Reduced chart-specific customization
- Easier long-term maintenance
The Coralogix Helm chart includes additional defaults and abstractions. Migrating removes this layer while preserving log ingestion into Coralogix.
What stays the same
This migration does not change how logs are ingested into Coralogix.
The following remain unchanged:
- Fluent Bit as the log collector
- Coralogix ingestion endpoints
- Authentication using your Coralogix private key
- Log structure, metadata, and parsing behavior
- Existing dashboards, alerts, and pipelines
No changes are required in the Coralogix UI.
What changes
| Area | Coralogix Helm chart | Official Fluent Bit Helm chart |
|---|---|---|
| Chart ownership | Coralogix | Fluent Bit project |
| Configuration style | Coralogix abstractions | Native Fluent Bit values |
| Upgrade cadence | Coralogix-managed | Upstream Fluent Bit |
| Defaults | Opinionated | Minimal |
You will need to explicitly configure outputs, filters, and parsers that were previously pre-configured by the Coralogix chart.
Migration overview
At a high level, the migration includes:
- Installing the official Fluent Bit Helm chart
- Translating Coralogix-specific values to native Fluent Bit configuration
- Validating log ingestion
- Removing the Coralogix Helm chart
You can run both charts side by side during migration.
Step 1: Add official Fluent Bit Helm repository
Add the Fluent Bit Helm repository:
Step 2: Create Namespace
Step 3: Create Coralogix secret
Create the secret containing your Coralogix private Send-Your-Data key:
kubectl create secret generic coralogix-keys \
--from-literal=PRIVATE_KEY=your-coralogix-private-key \
--namespace=fluent-bit
Replace:
<PRIVATE_KEY>with your Coralogix private key
Step 4: Create Lua Script ConfigMap
Create the ConfigMap containing the Lua script for metadata processing:
kubectl create configmap fluent-bit-http-crxluascript -n fluent-bit --from-literal=script.lua="RETURN_WITHOUT_MODIFYING_TIMESTAMP = 2
function addcrxmetadata(tag, timestamp, record)
new_record = record
new_record[\"applicationName\"] = record.json.kubernetes.namespace_name
if new_record[\"applicationName\"] == nil then
new_record[\"applicationName\"] = \"no-application\" end
new_record[\"subsystemName\"] = record.json.kubernetes.container_name
if new_record[\"subsystemName\"] == nil then
new_record[\"subsystemName\"] = \"no-subsystem\" end
local processed_fraction = string.format(\"%09d\", timestamp['nsec'])
new_record[\"timestamp\"] = string.format(\"%s%s\", timestamp['sec'], string.sub(processed_fraction, 1, -4))
return RETURN_WITHOUT_MODIFYING_TIMESTAMP, timestamp, new_record
end"
Step 5: Install Fluent Bit with override values
Install the official Fluent Bit chart using the provided override-values.yaml below:
helm install fluent-bit-http fluent/fluent-bit \
--namespace=fluent-bit \
--values ./override-values.yaml \
--set endpoint=ingress.eu1.coralogix.com
override-values.yaml
# This file replaces the need for the custom Coralogix chart by using the official chart with overrides
# Image configuration - using official Fluent Bit same version as Coralogix
Image:
repository: fluent/fluent-bit
tag: "3.2.10"
pullPolicy: IfNotPresent
# Command and args configuration
command:
- /fluent-bit/bin/fluent-bit
args:
- --workdir=/fluent-bit/etc
- --config=/fluent-bit/etc/conf/fluent-bit.conf
# Resource configuration
resources:
limits:
cpu: 100m
memory: 250Mi
requests:
cpu: 100m
memory: 250Mi
# Node
tolerations:
- operator: Exists
# Network configuration
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
# RBAC configuration
rbac:
nodeAccess: true
# Service monitor configuration
serviceMonitor:
enabled: false
additionalEndpoints:
- port: storage-metrics
path: /metrics
# Extra ports for metrics
extraPorts:
- port: 2021
containerPort: 2021
protocol: TCP
name: storage-metrics
# Environment variables
env:
- name: APP_NAME_SYSTEMD
value: systemd
- name: SUB_SYSTEM_SYSTEMD
value: kubelet
- name: HOSTNAME
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.name
# Environment variables from secrets
envFrom:
- secretRef:
name: coralogix-keys
# Template-based environment variables
envWithTpl:
- name: ENDPOINT
value: "{{ .Values.endpoint }}"
- name: LOG_LEVEL
value: "{{ .Values.logLevel }}"
# Fluent Bit configuration
config:
service: |
[SERVICE]
Daemon Off
Flush 1
Log_Level {{ .Values.logLevel }}
Parsers_File /fluent-bit/etc/parsers.conf
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
HTTP_Server On
HTTP_Listen 0.0.0.0
HTTP_Port 2020
Health_Check On
inputs: |
[INPUT]
Name fluentbit_metrics
Tag metrics
Scrape_Interval 5
Scrape_On_Start On
[INPUT]
Name tail
Tag kube.*
Path /var/log/containers/*.log
multiline.parser docker, cri
Refresh_Interval 5
Skip_Long_Lines On
Mem_Buf_Limit 25MB
DB /var/log/fluentbit-tail.db
[INPUT]
Name systemd
Tag host.*
Systemd_Filter _SYSTEMD_UNIT=kubelet.service
Read_From_Tail On
Mem_Buf_Limit 5MB
filters: |
[FILTER]
Name kubernetes
Match kube.*
K8S-Logging.Parser On
K8S-Logging.Exclude On
Use_Kubelet On
Annotations Off
Labels On
Buffer_Size 100MB
Keep_Log Off
Merge_Log_Key log_obj
Merge_Log On
tls.verify Off
[FILTER]
Name nest
Match kube.*
Operation nest
Wildcard *
Nest_Under json
[FILTER]
Name lua
Match kube.*
Script /fluent-bit/scripts/script.lua
Call addcrxmetadata
time_as_table true
[FILTER]
Name modify
Match host.*
Add applicationName systemd
Copy kubelet subsystemName
[FILTER]
Name nest
Match host.*
Operation nest
Wildcard _HOSTNAME
Wildcard SYSLOG_IDENTIFIER
Wildcard _CMDLINE
Wildcard MESSAGE
Nest_Under json
outputs: |
[OUTPUT]
Name prometheus_exporter
Match metrics
Host 0.0.0.0
Port 2021
[OUTPUT]
Name http
Match_regex ^(kube\..*|host\..*)$
Host {{ .Values.endpoint }}
Port 443
URI /logs/v1/singles
Format json_lines
tls On
Header Authorization Bearer ${PRIVATE_KEY}
Compress gzip
Retry_Limit False
net.keepalive Off
# Extra volumes for Lua script
extraVolumes:
- name: crxluascript
configMap:
name: fluent-bit-http-crxluascript
# Extra volume mounts
extraVolumeMounts:
- name: crxluascript
mountPath: /fluent-bit/scripts/script.lua
subPath: script.lua
# PrometheusRule configuration (commented out by default)
# prometheusRule:
# enabled: true
# rules:
# - alert: FluentbitNoOutputBytesProcessed
# expr: rate(fluentbit_output_proc_bytes_total[5m]) == 0
# annotations:
# description: |
# "FluentBit instance {{$labels.instance}}'s output plugin {{$labels.name}} has not processed any
# bytes for at least 15 minutes."
# summary: No Output Bytes Processed
# for: 2m
# labels:
# severity: critical
# - alert: FluentbitErrorRateIncreased
# expr: sum(rate(fluentbit_output_retries_failed_total[5m])) > 0
# annotations:
# description: |
# "FluentBit experiencing connectivity issues with Coralogix, issue may cause missing data for Coralogix"
# summary: Retries failed# for: 2m# labels:# severity: critical# - alert: FluentbitNoInput
# expr: sum by (pod) (rate(fluentbit_input_bytes_total[5m])) == 0
# annotations:
# description: |
# "FluentBit is having 0 data incoming, restart the pod {{$labels.pod}}"
# summary: FluentBit no input coming
# for: 2m
# labels:
# severity: warning
# Default configuration values
endpoint: ingress.eu1.coralogix.com
logLevel: error
# Dynamic metadata configuration (extract from log fields)
dynamic_metadata:
app_name: kubernetes.namespace_name
sub_system: kubernetes.container_name
# Static metadata configuration (hardcoded values)
static_metadata:
app_name: ""
sub_system: ""
Support
Need help?
Our world-class customer success team is available 24/7 to walk you through your setup and answer any questions that may come up.
Feel free to reach out to us via our in-app chat or by sending us an email at support@coralogix.com.