{"id":28409976,"url":"https://github.com/crowdstrike/kubernetes-fluentbit-logging-falcon-logscale-integration","last_synced_at":"2026-02-08T16:03:07.948Z","repository":{"id":204547862,"uuid":"681295139","full_name":"CrowdStrike/Kubernetes-FluentBit-Logging-Falcon-Logscale-Integration","owner":"CrowdStrike","description":"Integration to capture and send kubernetes logs and metrics to Falcon LogScale using the FluentBit observability pipeline","archived":false,"fork":false,"pushed_at":"2024-05-22T16:47:59.000Z","size":383,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-09-10T06:21:38.308Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CrowdStrike.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-08-21T17:44:28.000Z","updated_at":"2024-05-22T16:48:02.000Z","dependencies_parsed_at":null,"dependency_job_id":"80280bd7-dfc1-4871-9b51-aec6b6b75dbb","html_url":"https://github.com/CrowdStrike/Kubernetes-FluentBit-Logging-Falcon-Logscale-Integration","commit_stats":null,"previous_names":["crowdstrike/kubernetes-fluentbit-logging-falcon-logscale-integration"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/CrowdStrike/Kubernetes-FluentBit-Logging-Falcon-Logscale-Integration","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2FKubernetes-FluentBit-Logging-Falcon-Logscale-Integration","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2FKubernetes-FluentBit-Logging-Falcon-Logscale-Integration/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2FKubernetes-FluentBit-Logging-Falcon-Logscale-Integration/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2FKubernetes-FluentBit-Logging-Falcon-Logscale-Integration/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CrowdStrike","download_url":"https://codeload.github.com/CrowdStrike/Kubernetes-FluentBit-Logging-Falcon-Logscale-Integration/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2FKubernetes-FluentBit-Logging-Falcon-Logscale-Integration/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29236141,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-08T14:18:14.570Z","status":"ssl_error","status_checked_at":"2026-02-08T14:18:14.071Z","response_time":57,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-02T11:09:33.262Z","updated_at":"2026-02-08T16:03:07.919Z","avatar_url":"https://github.com/CrowdStrike.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"![CrowdStrike Falcon LogScale Kubernetes-Fluent-Bit-Logging Integration](/docs/assets/cs-logo.png)\n\n[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike\u0026style=social\u0026url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)\u003cbr/\u003e\n\n# Kubernetes log forwarding with the Fluent-Bit log shipper\n\nForward Kubernetes logs and system metrics to Falcon LogScale with the fluent-bit log shipper.\n\n## Overview\n\nThis integration provides instructions on how to configure the Fluent-Bit log shipper to forward Kubernetes cluster logs and node metrics to Falcon LogScale for ingestion.\n\nThis integration was created as a companion to the LogScale [Kubernetes Logging Package](https://github.com/CrowdStrike/logscale-community-content/tree/main/Log-Sources/Kubernetes/Fluent-Bit-Logging) which is available on the [CrowdStrike Lgscale Community Content GitHub](https://github.com/CrowdStrike/logscale-community-content) repository.\n\n*note: The Kubernetes Logging package dashboards rely on specific enrichments added by this integration.*\n\n## Fluent-bit\n\n[Fluent-Bit](https://fluentbit.io/) is a fast and lightweight end-to-end log processing pipeline that collects, filters, and forwards logs and metrics.  It is an [open source](https://docs.fluentbit.io/manual/about/what-is-fluent-bit) sub-project of the [CNCF](https://www.cncf.io/).\n\nFluent-bit is written in C.  It provides a variety of plugins to input, filter, and output logging telemetry.  It can be run as system level service or as a DaemonSet within Kubernetes.\n\n## Implementation Notes\n\nThis integration employs a split horizon setup of fluent-bit in order to capture a complete view of Kubernetes cluster logging telemetry: that is, fluent-bit is run simultaneously as a system service outside of Kubernetes, and as a DaemonSet within Kubernetes.\n\nAs a DaemonSet, fluent-bit monitors and forwards well known Kubernetes log sources: container, docker, audit.\n\nAs a system service, fluent-bit collects and forwards a variety of node metrics (cpu, network, disk, memory), and Docker events.\n\nThe split horizon implementation reflects the current state of fluent-bit namespace contraints among the various fluent-bit input plugins: metrics scraping is currently only possible from the system level where the fluent-bit metrics `[INPUT]` plugins have access to special device files in /proc and /sys.\n\nMetrics capture is not currently possible when running fluent-bit from within a Kubernetes container.\n\nLogs collected by the DaemonSet are automatic enriched with a set of Kubernetes properties: `i.e. \"kubernetes\": { ... }`\n\n```json\n{\n    \"@timestamp\": \"2023-XX-XXTXX:XX:XX.XXXZ\",\n    \"log\": \"[2023/XX/XX XX:XX:XX] [ info] [engine] flush chunk '1-1111111111.111111111.flb' succeeded at retry 2: task_id=7, input=tail.1 \u003e output=es.0 (out_id=0)\\n\",\n    \"stream\": \"stderr\",\n    \"time\": \"2023-XX-XXTXX:XX:XX.000000000Z\",\n    \"source\": \"container\",\n    \"hostname\": \"host.name.com\",\n    \"kubernetes\": {\n        \"pod_name\": \"fluent-bit-tsv4f\",\n        \"namespace_name\": \"logging\",\n        \"pod_id\": \"nnnnnnnn-nnnn-nnnn-nnnn-nnnnnnnnnnnn\",\n        \"labels\": {\n            \"app.kubernetes.io/instance\": \"fluent-bit\",\n            \"app.kubernetes.io/name\": \"fluent-bit\",\n            \"controller-revision-hash\": \"1111111111\",\n            \"pod-template-generation\": \"2\"\n        },\n        \"annotations\": {\n            \"checksum/config\": \"nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn\",\n            \"checksum/luascripts\": \"nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn\",\n            \"cni.projectcalico.org/containerID\": \"nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn\",\n            \"cni.projectcalico.org/podIP\": \"10.10.10.11/32\",\n            \"cni.projectcalico.org/podIPs\": \"10.10.10.11/32\",\n            \"kubectl.kubernetes.io/restartedAt\": \"2023-XX-XXTXX:XX:XX-XX:XX\"\n        },\n        \"host\": \"host.name.com\",\n        \"container_name\": \"fluent-bit\",\n        \"docker_id\": \"nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn\",\n        \"container_hash\": \"cr.fluentbit.io/fluent/fluent-bit@sha256:nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn\",\n        \"container_image\": \"cr.fluentbit.io/fluent/fluent-bit:2.0.8\"\n    }\n}\n```\n\n\n## Installation and Setup\n\n### Install the Kubernetes Logging LogScale package \n[Kubernetes Logging Package](https://github.com/CrowdStrike/logscale-community-content/tree/main/Log-Sources/Kubernetes/Fluent-Bit-Logging) \n*note: the `fluentbit` parser is included in the package*\n\n### (system) Install Fluent-Bit as a System Service\n*note: this integration assumes Ubuntu Linux as the target platform*\n#### Ubuntu APT install\n[Apt Install Fluent-Bit](https://docs.fluentbit.io/manual/installation/linux/ubuntu)\n`sudo apt-get install fluent-bit`\n\n#### Configure Fluent-Bit\n\nPrepare the `/etc/fluent-bit/fluent-bit.conf` file.  \nUse the `fluent-bit.conf` template file included with this integration to source the `[INPUT]`, `[FILTER]`, and `[OUTPUT]` stanzas.  \nUpdate the `[OUTPUT]` stanza with your LogScale ingest credentials.  \n*note: a fluent-bit timestamp is added to some metrics events that lack native timestamping.*  \n\n#### Start Fluent-Bit Service\n\n`sudo systemctl start fluent-bit`  \nVerify that events are being ingested to the repository.  \n\n### (k8s) Install Fluent-Bit as a Kubernetes DaemonSet\n\nUse the upstream fluentbit opensource distribution to install a daemonset through a helm chart. \n\n#### Create a Logging namespace\n\n`kubectl create namespace logging`\n\n#### Prepare the Helm Chart\n\nFollow the instructions in the [guide to installing Fluent-Bit via Helm](https://fluentbit.io/blog/2020/12/29/5-minute-guide-to-deploying-fluent-bit-on-kubernetes/) to install the base Fluent-Bit DaemonSet from the public helm chart https://github.com/fluent/helm-charts/ \n\n##### Configure the Fluent-Bit Helm Chart\n\n###### ConfigMap\n\nUse the included `fluent-bit.conf` template file to provide the stanzas for `[INPUT]`, `[FILTER]`, and `[OUTPUT]`.\nUpdate the `[OUTPUT]` stanza with your LogScale ingest credentials.\n\n###### Tolerations\n\nAdd a toleration to the DaemonSet, to allow Fluent-Bit to be scheduled on control-plane master nodes:\n```\n      tolerations:\n      - effect: NoSchedule\n        key: node-role.kubernetes.io/control-plane\n        operator: Exists\n      - effect: NoSchedule\n        key: node-role.kubernetes.io/master\n        operator: Exists\n```\n\n###### Auditing\n\nUpdate the fluent-bit ClusterRole yaml to allow access to `events` resources:\n\n```\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n  annotations:\n  . . .\n  . . .\nrules:\n- apiGroups:\n  - \"\"\n  resources:\n  - namespaces\n  - pods\n[[- events]] add this resource \u003c-------\n  verbs:\n  - get\n  - list\n  - watch\n```\n\n*note: without `events` resource access, the following error will occur:*\n\n```\n{\"log\":\"[2023/XX/XX XX:XX:XX] [error] [input:kubernetes_events:kubernetes_events.4] http_status=403:\\n\",\"stream\":\"stderr\",\"time\":\"2023-XX-XXTXX:XX:XX.XXXXXXXXXZ\"}\n{\"log\":\"{\\\"kind\\\":\\\"Status\\\",\\\"apiVersion\\\":\\\"v1\\\",\\\"metadata\\\":{},\\\"status\\\":\\\"Failure\\\",\\\"message\\\":\\\"events is forbidden: User \\\\\\\"system:serviceaccount:logging:fluent-bit\\\\\\\" cannot list resource \\\\\\\"events\\\\\\\" in API group \\\\\\\"\\\\\\\" at the cluster scope\\\",\\\"reason\\\":\\\"Forbidden\\\",\\\"details\\\":{\\\"kind\\\":\\\"events\\\"},\\\"code\\\":403}\\n\",\"stream\":\"stderr\",\"time\":\"2023-XX-XXTXX:XX:XX.XXXXXXXXZ\"}\n```\n\n##### Helm Install Fluent-Bit\n`helm install fluent-bit .`\n\nOnce fluent-bit is enabled and the DaemonSet is running on all nodes, events should begin to appear in LogScale.\n\n---\n\n\u003cp align=\"center\"\u003e\u003cimg src=\"/docs/assets/cs-logo-footer.png\"\u003e\u003cBR/\u003e\u003cimg width=\"250px\" src=\"/docs/assets/adversary-red-eyes.png\"\u003e\u003c/P\u003e\n\u003ch3\u003e\u003cP align=\"center\"\u003eWE STOP BREACHES\u003c/P\u003e\u003c/h3\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcrowdstrike%2Fkubernetes-fluentbit-logging-falcon-logscale-integration","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcrowdstrike%2Fkubernetes-fluentbit-logging-falcon-logscale-integration","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcrowdstrike%2Fkubernetes-fluentbit-logging-falcon-logscale-integration/lists"}