Tracee Now Natively Supports Fluent Bit and Fluentd
Easily add eBPF data to your telemetry pipeline
The newest version of Aquasec’s Tracee tool (v0.12.0) now supports sending all events directly to Fluent Bit or Fluentd via the Fluent Forward receiver. This enables Tracee users to take advantage of the Fluent projects’ powerful in-stream processing and filtering capabilities before forwarding the output to any of the dozens of backends supported by the projects. Users familiar with the Fluentd logging driver for Docker will recognize a similar approach.
Last summer, we demonstrated a way to integrate Tracee and Fluent Bit, but that process required us to output the eBPF from Tracee as JSON and forward it to a log file that the Fluent Bit service could then read. With support for the Fluent Forward receiver now native with Tracee, the millions of Fluent users can now easily add eBPF data into their observability efforts, allowing kernel layer insights. You could, for example, send eBPF data through Fluent Bit to Grafana Loki, or even Loki, Elasticsearch, and Splunk all at the same time.
For information on how to configure Tracee to send data to Fluent, check out the Tracee docs. Be aware that Tracee v0.12 includes some breaking changes, so exercise appropriate caution as you begin to explore this new feature.
You might also like
A practical guide for avoiding data loss and backpressure problems with Fluent Bit
Learn how to detect and avoid backpressure problems with Fluent Bit by balancing memory-based and filesystem-based buffering.
Calyptia joins Chronosphere to build the future of observability
Today we are excited to announce that Calyptia is now part of Chronosphere. This will bring new benefits and opportunities to both Calyptia and Chronosphere customers while we continue to provide a vendor neutral approach to control observability data to any backend.