Fluent Bit

[OlleLarsson]

What should be investigated. Fluentd consumes quite a bit of resources on all of the hosts. We want to minimize the footprint, if possible, of the ck8s services, and Fluent Bit should consume much less memory than Fluentd

There are two approached of interest that we should investigate:

• Simple replacement of Fluentd with Fluent Bit, meaning that each agent writes to Opensearch just like Fluentd is doing right now.
• Forward - Aggregator pattern, were the forwarders are Fluent Bit and the aggregator is either Fluentd or Fluentd

What artifacts should this produce.

• PoC of both approaches if possible.
• Pros and Cons of the tested approaches