Skip to content

Getting started

This page takes you from the AWS Marketplace listing to your first log record delivered by Fluent Bit. It takes about ten minutes.

You need: an AWS account with permission to subscribe to AWS Marketplace products and launch EC2 instances.

1. Subscribe

Open the Fluent Bit Log Gateway listing, choose View purchase options, review the terms and subscribe.

2. Launch the instance

Choose Launch your software and use these settings:

  • Instance type: t3.medium.
  • Storage: an encrypted gp3 root volume of at least 16 GiB.
  • IAM instance profile: a role with the AWS managed policy AmazonSSMManagedInstanceCore, so you can connect with Session Manager.
  • Security group: no inbound rules are needed. If you want SSH as well, allow port 22 only from your own administrative network.
  • Metadata: require IMDSv2.

3. Connect and check first boot

In the EC2 console, select the instance, choose Connect, then Session Manager. Wait for first boot and check the services and listeners:

cloud-init status --wait
systemctl is-active sushi-fluent-bit-firstboot.service fluent-bit.service
ss -H -lnt | awk '$4 ~ /:(9880|2020)$/ { print $4 }'

Both units should report active, and both listeners should be on 127.0.0.1.

4. Run the walkthrough

sudo -iu ubuntu
bash /opt/sushi/docs/demo.sh

It checks the monitoring API, confirms that plain HTTP to the ingest port is refused, sends a test record over HTTPS, and then runs the image's self-test. It ends with SUSHI_CUSTOMER_DEMO_PASSED.

5. Send your own record

Clients verify the server with the public copy of the certificate at /usr/local/share/sushi/fluent-bit/cert.pem:

curl --fail --http1.1 --cacert /usr/local/share/sushi/fluent-bit/cert.pem \
  -H 'content-type: application/json' \
  -d '{"event":"hello","source":"localhost"}' \
  https://127.0.0.1:9880/ingest.local

A successful request returns HTTP 201. Within a few seconds the record appears in the local destination:

sudo tail -n 5 /var/lib/fluent-bit/out/accepted.log

Next: Configuration, to send logs on to your own destinations.