>fluentd

fluentd

An image that normalizes heterogeneous logs into structured events and routes them to multiple backends simultaneously

fluent/fluent-bit

opensearchproject/opensearch

grafana/loki

prom/prometheus

What is fluentd image?

The fluentd image packages Fluentd, a Ruby-based, plugin-driven log processor used to collect, parse, filter, and forward logs at scale. With 1,000+ plugins, Fluentd can normalize heterogeneous logs into structured events and route them to multiple backends simultaneously. It’s commonly deployed as a node-level DaemonSet in Kubernetes, as a sidecar for app pods, or as a centralized aggregator that fans out to storage and analytics systems.

Fluentd is well suited to containerized infrastructure: it can tail files, read container stdout/stderr, accept forward/HTTP inputs, enrich with Kubernetes metadata, and apply flexible filtering and buffering policies (memory or file). Teams use it to standardize logging pipelines, reduce log noise, and decouple application logging from backend storage choices.

How to use this image

The Fluentd image runs with a configuration file that defines inputs, filters, buffers, and outputs. You can mount configs at runtime or bake them into a custom image for reproducibility.

Run with a local config file:

docker run --rm -p 24224:24224 -p 9880:9880 \
  -v $(pwd)/fluent.conf:/fluentd/etc/fluent.conf \
  fluent/fluentd

Example fluent.conf:

<source>
  @type forward
  port 24224
</source>

<filter **>
  @type record_transformer
  <record>
    app "my-service"
  </record>
</filter>

<match **>
  @type stdout
</match>

Build a custom image with plugins preinstalled (recommended for prod):

FROM fluent/fluentd
USER root
RUN gem install fluent-plugin-elasticsearch
COPY fluent.conf /fluentd/etc/fluent.conf
USER fluent

Fluentd writes logs to stdout. Common ports: 24224/tcp (forward input) and 9880/tcp (HTTP input). File buffering can be enabled to improve durability during backend outages.

Image variants

Published under fluent/fluentd, the image is available in multiple variants:

fluent/fluentd:latest
Tracks the most recent stable release.
Use for local testing or evaluation.‍
fluent/fluentd:<version>
Version-pinned tag (e.g., v1.x.y).
Recommended for production to ensure reproducibility.‍
fluent/fluentd:<version>-rootless
Runs Fluentd as a non-root user by default.
Prefer for hardened environments and stricter security policies.‍
fluent/fluentd:<version>-alpine (when available)
Smaller Alpine-based variant.
Minimizes footprint but may require extra libraries for some plugins.

Fluentd images are rebuilt to include upstream and dependency security updates. Pin exact tags (for example, fluent/fluentd:v1.x.y-rootless) and bake plugins into the image for reliable deployments.

Interested in base images that start and stay clean?

Oops! Something went wrong while submitting the form.