Configure a custom Fluent Bit log drain

Use Custom FluentBit when the built-in Axiom and New Relic destinations do not match your logging provider. Coolify runs the configuration as supplied, so you must define the input, filters, parsing, output, authentication, and destination behavior that your provider requires.

Before you start

Read the Fluent Bit configuration documentation before writing the configuration.

Treat the configuration as sensitive when it contains credentials. Coolify does not provide a separate custom environment-variable field for provider secrets.

How Coolify runs the configuration

By default, Coolify writes these files on the resource server:

The container mounts the two configuration files at /fluent-bit.conf and /parsers.conf.

Write the main configuration

This skeleton shows the required input and an example HTTPS output. Replace the host, URI, authentication, and output options with values supported by your provider:

[SERVICE]
    Flush        5
    Daemon       off
    Log_Level    info
    Parsers_File parsers.conf

[INPUT]
    Name              forward
    Listen            0.0.0.0
    Port              24224
    Buffer_Chunk_Size 1M
    Buffer_Max_Size   6M

[OUTPUT]
    Name   http
    Match  *
    Host   logs.example.com
    Port   443
    URI    /ingest
    format json
    tls    On

The example is not a complete configuration for a specific provider. Add the provider's required header, token, payload, retry, and TLS options before enabling the drain.

Use only input, filter, parser, and output plugins included in the Fluent Bit 2.0 image used by Coolify.

Add parser definitions

Custom Parser Configuration is optional. It becomes parsers.conf, but adding a parser definition does not apply it automatically. The main configuration must reference the parser.

For example, add this parser definition to Custom Parser Configuration:

[PARSER]
    Name   app_json
    Format json

Then add a parser filter to Custom FluentBit Configuration:

[FILTER]
    Name         parser
    Match        *
    Key_Name     log
    Parser       app_json
    Reserve_Data On

This example parses JSON stored in the incoming log field and preserves the other record fields.

Configure Coolify

1. Open Servers and select the server that runs the resources.
2. Open Configuration > Log Drains.
3. In Custom FluentBit, keep Enabled off.
4. Paste the complete main configuration into Custom FluentBit Configuration.
5. If needed, paste parser definitions into Custom Parser Configuration.
6. Select Save in the custom section.
7. Turn on Enabled. Coolify writes the files and starts coolify-log-drain.

Enable a resource

Follow Enable log draining for a resource, then restart or redeploy the resource.

Your custom configuration receives the Docker log record as delivered by the local Fluentd driver.

Verify delivery

1. Cause the opted-in resource to write a recognizable message to stdout or stderr.
2. Wait for the Flush interval in your configuration.
3. Confirm the message appears in the external destination.
4. Confirm the Fluent Bit container remains running:

docker ps --filter name=coolify-log-drain
docker logs --tail 100 coolify-log-drain

Run these commands in Coolify's server terminal or over SSH on the server that hosts the resource.

Update the configuration

The configuration fields are read-only while the drain is enabled.

1. Turn off Enabled to stop coolify-log-drain.
2. Update the main or parser configuration.
3. Select Save.
4. Turn on Enabled again.
5. Generate a new resource log and verify the result externally.

Fix a failed custom drain

• Confirm the main configuration has a forward input listening on port 24224.
• Read docker logs --tail 100 coolify-log-drain for syntax, plugin, DNS, TLS, and authentication errors.
• Confirm every parser referenced by the main configuration exists in Custom Parser Configuration.
• Confirm the selected plugins and options are available in Fluent Bit 2.0.
• Confirm the resource's Drain Logs setting is enabled and that the resource was restarted afterward.
• Confirm the resource server can reach the configured output host and port.

Continue with log drains