An event is a discrete record representing an occurrence or data item processed by a telemetry system. In Fluent Bit, events are the primary units that inputs ingest, plugins process, and outputs route or deliver. section 1.2
An event can represent a log, metric, or trace. Its structure combines routing metadata, temporal context, and the actual telemetry payload. section 1.2.1
Each event contains three mandatory elements:
- Metadata: a list of key-value pairs containing the mandatory Tag. Fluent Bit uses the Tag as a logical name for routing events to operations. section 1.2.1
- Timestamp: the time associated with the occurrence or receipt of the event. Without it, determining recency, order, cause, or effect becomes difficult. section 1.2.1
- Record: the event data, such as a log, metric, or trace. Log records may be key-value pairs or a single text block, depending on input and parsing. section 1.2.1
Figure 1.1 Log event structure for Fluent Bit v1.x and Fluentd (left) and Fluent Bit from v1.9 (right)
Compare the event structure used by Fluent Bit v1.x and Fluentd with the expanded metadata model introduced in Fluent Bit v1.9. section 1.2.1
Container and Kubernetes telemetry
Container engines, orchestration components, clusters, and applications all produce events that need to be captured. Fluent Bit can ingest these perspectives as part of observing containerized and Kubernetes environments. section 4.1 section 4.7
