Fluentd

What it is

Fluentd is a unified logging layer written in Ruby that collects, parses, buffers, and routes log data from wherever it's generated to wherever it needs to go — Elasticsearch, S3, Kafka, BigQuery, Splunk, you name it. It sits in the "Observability and Analysis" category because it's the plumbing that makes logs usable, not a dashboard or query engine itself. Core design: input plugins ingest data, filter plugins transform it, output plugins ship it, and buffer plugins handle backpressure so downstream outages don't mean data loss. Over 500 plugins exist in the ecosystem, which is both its biggest strength and its biggest maintenance liability depending on which ones you pull in.

Who builds it and why

Fluentd is a CNCF graduated project, meaning it's cleared the bar for production adoption at scale, sustained contributor activity, and documented governance. 285 contributors and continued commits (latest activity July 2026) show it's not abandoned — but graduated CNCF status doesn't mean "hot," it means "boring and stable," which for a logging agent is exactly what you want. Originally built by Treasure Data to solve their own log pipeline problems, it's since become infrastructure that a broad set of companies depend on rather than a single vendor's pet project. That matters for a tool that sits directly in your data path — you don't want its roadmap tied to one company's business model.

Production readiness signal

13,550 GitHub stars and 285 contributors is a solid, mature signal — this isn't a project running on two maintainers' goodwill. Apache-2.0 license means no copyleft surprises for commercial use. Latest release v1.19.3 indicates active, incremental version discipline rather than big-bang rewrites, which is what you want in something that touches every log line in your infrastructure. The main thing to verify yourself: plugin-level maturity varies wildly. Core Fluentd is rock solid; the third-party plugin you need for your specific output target might be maintained by one person and untouched for two years. Check the plugin's own repo before trusting it in prod.

Who should use this

Teams running heterogeneous infrastructure (bare metal, VMs, k8s, mixed cloud) who need one logging agent that can normalize output across all of it. Anyone already committed to the "unified logging layer" pattern — feeding multiple backends (SIEM + long-term storage + real-time alerting) from a single pipeline. Kubernetes shops using Fluentd as a DaemonSet for cluster-wide log collection, which is the single most common production deployment pattern for it. Also a good fit if you need heavy in-flight transformation (parsing, filtering, enriching) before data lands anywhere.

Who should NOT use this

If you're purely Kubernetes-native and want something lighter-weight, Fluent Bit (Fluentd's own sibling project) is the better default — Fluentd's Ruby runtime and plugin model carry more memory and CPU overhead than Fluent Bit's C-based agent, and most greenfield k8s deployments should start with Fluent Bit and only reach for Fluentd when they need its richer plugin ecosystem. If your team has zero Ruby familiarity and you hit a plugin bug, debugging or patching it yourself will be painful. If you need a single vendor to call when something breaks and want an SLA, Fluentd alone doesn't give you that — you're on community support unless you buy a commercial distribution. And if your logging needs are simple (one source, one destination, no transformation), Fluentd is over-engineering; a simpler shipper will do.

Alternatives

• Fluent Bit — lighter, faster, C-based sibling project; better fit for resource-constrained or purely k8s environments.
• Logstash (Elastic stack) — deeper native integration if you're already all-in on Elasticsearch/Kibana, but heavier and JVM-based.
• Vector — newer, Rust-based, strong performance and increasingly broad plugin support; worth evaluating if you're starting fresh.

Pricing

Fully open source, Apache-2.0. No paid tier, no license fees. Commercial support is available through third parties (e.g., Treasure Data), but the core project itself costs nothing to run.