Best Way to Send High-Frequency Logs (100ms Int) from Fluent Bit to Zabbix (v6.4.13)

[h0ng]

Hi all,
I’m currently working on a project where a device (a Raspberry Pi running Fluent Bit) generates log entries roughly every 100ms. I’m trying to ingest this data into Zabbix v6.4.13, but with the following constraint:

• I only want to install Fluent Bit on the Pi and use Zabbix on the server, no additional agents or binaries like zabbix_sender.

What I'm considering

1. Fluent Bit + Zabbix HTTP Agent Item
   • I configured Fluent Bit to expose logs via the http output plugin.
   • Then used a Zabbix HTTP agent item to poll that endpoint.
   • This works technically, but:
     • It only captures one value per poll.
     • Polling intervals can’t match the 100ms frequency - Zabbix polls too slowly.
     • Any logs generated between polls are lost.

What I Can’t Use

• zabbix_sender or custom scripts, installation of extra tools on the data source is not allowed.
• Trapper + Push methods, still require installing something like zabbix_sender or curl automation, which is not ideal for this setup.

What I Need

• A solution that:
  • Captures every log line or at least batches multiple 100ms logs.
  • Works with only Fluent Bit on the sender side and Zabbix on the receiver.
  • Can feed logs into Zabbix (even if with minor latency), as long as no logs are dropped

[PavelZ]

Grafana Loki is considered a fairly lightweight system now. But still, expect at least 200-300 MB RAM for single binary setup.

Grafana has specific LIVE button for logs.

With Grafana you can still pull individual metrics from Zabbix and display combined dashboards

[h0ng]

Thanks for the suggestion! Loki looks useful for log viewing, but in this project I’m specifically required to send logs into Zabbix 6.4.13 using only Fluent Bit (no Loki, no external agent)

[PavelZ]

Many modern agents can send logs to Loki - https://docs.fluentbit.io/manual/pipeline/outputs/loki

If you were paid to do this kind of work, of course there is nothing to discuss. Let's see what you can do.

[cyber]

So basically you want something that does things, that are not possible... from one side only Fluentbit, which has no knowledge of Zabbix and from other side Zabbix, for which you cannot install any additional binaries and which most probably cannot handle that amount of data...

https://www.zabbix.com/documentation/current/en/manual/concepts/sender

zabbix_sender realtime sending scenarios will gather multiple values passed to it in close succession and send them to the server in a single connection. A value that is not further apart from the previous value than 0.2 seconds can be put in the same stack, but maximum polling time still is 1 second.

In any scenario you need either a custom "middleman", which can accept all your data and forward it to zabbix in reasonable rate in batches, or you need to look for different endpoint type...

For v8, theres some hope in roadmap...I think... as FluentBit allows sending to OpenTelemetry endpoint...

Observability

• OpenTelemetry data collection
  Collection and processing of OpenTelemetry tracing data
  Top voted!
• OpenTelemetry data visualization
  Visualization of OpenTelemetry tracing data
  Top voted!
• Optimized storage engine for telemetry
  A new storage engine optimized for high-performance storage and retrieval of large volumes of tracing, log, and time-series data

[Brambo]

Why not let a local script gather all log for the hole second and let that be presented to the webpage for http agent.
Local script can be bash (no additional software) and how you present the log is the same challenge you have now without any additional software.
I think zabbix_sender is still an easier way forward but you don't want that.