No way to deploy a stateful fluent-bit aggregator

[dixneuf19]

Hi,

We are in the process of updating our logging stack in Kubernetes, and would like to go all in into fluent-bit.

Currently we have

• fluent-bit as collector (daemonset)
• fluentd as aggregator (StatefulSet)
• Opensearch/ElasticSearch as output

We would like to use fluent-bit as aggregator too, to have only one tool to maintain. It seems (reading the latest doc) that fluent-bit would be OK for us, since we don't have any advanced filtering needs.

Both Fluentd and Fluent Bit can work as Aggregators or Forwarders, and can complement each other or be used as standalone solutions.
In the recent years, cloud providers have switched from Fluentd to Fluent Bit for performance and compatibility. Fluent Bit is now considered the next-generation solution.

Since our Opensearch may have some interruptions of service, we would like to have some persistence on the Aggregator, to be able to have some backpressure on filesystem and not lost any logs if there is a localized incident on Opensearch. In Kubernetes, it means using a StatefulSet.

However this official Helm Charts and Operator, fluent-bit is never deployed as StatefulSet and Aggregator (but fluentd is), always as a stateless daemonset or deployment.

Are we trying something newish not yet properly supported by the charts, or are there any reasons which explain this lack of support for a Stateful fluent-bit aggregator ?

Thanks for your help

(FYI I also posted on the Slack)

[jfharden]

I'd also like the ability to deploy as a stateful set, in our case we're going to use fluent bit to receive kubernetes events and forward them to elasticsearch (outside the cluster), for this use case we only want a single instance running with a persistent volume across the whole cluster, so a stateful set would be really useful.