Fluentd

Fluentd is an open-source data collector for building a unified logging layer across many sources and destinations. It suits engineers who can operate self-hosted infrastructure and need adaptable routing more than a managed dashboard. The zero licence cost is attractive, but deployment, maintenance and security remain your responsibility.

Overview

Fluentd uses JSON to collect, filter, buffer and forward logs, giving teams a consistent pipeline for otherwise unrelated application and system records. It is a foundation for centralised logging rather than a complete analysis interface, so you select destinations and design the routing model yourself.

Conceived and open-sourced in 2011, Fluentd is now a graduated Cloud Native Computing Foundation project, with components under the Apache 2 License. The project says more than 5,000 data-driven companies use it, including a largest deployment collecting from over 50,000 servers. Community assistance and companies offering commercial Fluentd enterprise services provide support beyond the software.

Key features

Collection, parsing and routing

Log pipelines, structured parsing and live tailing cover the main collection workflow. JSON processing lets you filter and reshape events before delivery, while archive export supports retention and later analysis. This flexibility is useful when different teams need different outputs, but it also means designing and maintaining your own pipeline rules.

Plugin ecosystem

More than 500 community plugins connect dozens of data sources and outputs. Listed integrations include Elasticsearch and Kibana, Splunk, Amazon S3, Kafka, BigQuery, Datadog and OpenTelemetry. That breadth can reduce custom connector work and make Fluentd a practical hub in mixed environments; plugin quality and long-term maintenance can vary, so larger deployments need an ownership plan.

Buffering and resilience

Memory and file buffering, failover and high-availability features are aimed at preventing data loss between nodes and destinations. File buffering is the more durable choice when restarts or destination outages matter, while memory buffering trades persistence for lower storage overhead. A vanilla instance uses 30–40 MB of memory and can process 13,000 events per second per core, useful for resource-conscious collectors, although real throughput depends on parsing, plugins and outputs.

Security and operations

Vulnerabilities CVE-2026-44024, CVE-2026-44025, CVE-2026-44160 and CVE-2026-44161 were patched in Fluentd v1.19.3. The project advises updating fluent-package to v6.0.4, making update management an essential operating task.

Pricing

There are no licence charges or paid tiers. That suits teams with engineering capacity to run collectors, storage and destinations themselves. It does not remove infrastructure, support or operational costs, and commercial support is supplied by third-party Fluentd service companies.

Platforms

Fluentd v1 runs on Linux, Mac OSX and Windows, with self-hosted deployment. Community distributions include Docker images, a Kubernetes DaemonSet and Ruby gems. This range fits local development, servers and container platforms, but the self-hosted model leaves capacity, upgrades and availability to your team.

Who it's for

Choose Fluentd when you need a programmable collection layer across varied systems, want many prebuilt integrations, or need control over buffering and failover. It is particularly suitable for organisations already operating Linux, Windows or Kubernetes infrastructure. Look elsewhere if you want a managed service with vendor-operated storage, dashboards and scaling, or if your team cannot own patching and pipeline maintenance.

Pros and cons

• Pros: Apache 2 licensing keeps software cost at zero; 500-plus plugins cover a wide range of sources and destinations; JSON processing, structured parsing and archive export support varied workflows; file and memory buffering plus failover address destination outages; modest baseline memory use suits lightweight collectors; runs across Linux, Mac OSX and Windows with container options.
• Cons: Self-hosting puts upgrades, availability, storage and security on your team; plugin-heavy designs require governance and maintenance; Fluentd provides the pipeline foundation, so analysis and presentation depend on the destinations you configure.

Alternatives

ELK Stack is the better fit when you want a self-managed Elastic Stack or a usage-priced Logs Essentials option, with API, desktop and server platform coverage.

Google Cloud Logging suits teams preferring a managed Google service, with web and API access and a stated 50 GiB-per-project-per-month free storage allowance for non-vended network logs.

Amazon CloudWatch Logs is a choice for AWS environments that want pay-as-you-go ingestion, including a published 0.50 USD-per-month rate for the first 10 TB per month in US East (N. Virginia).

Oracle Cloud Infrastructure Logging fits Oracle users seeking a free allowance of 10 GB log storage per month before usage charges.

Oracle Log Analytics is another Oracle-oriented option with a free first 10 gigabytes of log storage.

Sumo Logic offers a hosted web service with a free tier of 20 daily credits, seven-day log retention and up to three users.

Grafana Loki is worth choosing for a self-hosted or Grafana Cloud logs workflow, including a free cloud tier with 50 GB monthly ingestion and 14-day retention.

Logstash is a free alternative for teams seeking Elastic's default distribution and its broad processing approach.

For a wider shortlist, browse Log Management Software and Telemetry Pipeline Software.

Verdict

Fluentd is a strong choice for infrastructure teams that want an open, extensible logging layer and are prepared to run it themselves. Its plugin breadth and buffering and failover controls are the main reasons to choose it. Prefer a managed logging service when your priority is vendor-operated scaling, storage and maintenance rather than pipeline control.