AWS for Fluent Bit 3.0.0 Based on Fluent Bit 4.1.0

AWS for Fluent Bit 3.0.0 transforms container logging with native OTLP support, faster JSON parsing, and enhanced security controls on Amazon Linux 2023, eliminating the need for additional sidecar containers in your ECS and EKS environments.

haruki

Published Oct 17, 2025

Last modified Oct 17, 2025

Introduction

On October 14, 2025, AWS released AWS for Fluent Bit 3.0.0, a log collection tool for Amazon ECS and Amazon EKS.

This version represents a major update based on Fluent Bit version 4.1.0 and Amazon Linux 2023.

Container logging using AWS for Fluent Bit is now more performant and more feature-rich, with native OpenTelemetry support, significant performance improvements, and enhanced security.

This release is immediately available in all AWS commercial regions and AWS GovCloud (US) regions.

This article covers the details of new features, differences from previous versions, practical usage, and costs and limitations.

Feature Overview

AWS for Fluent Bit 3.0.0 has been significantly upgraded from previous versions and is based on Fluent Bit version 4.1.0 and Amazon Linux 2023.

Key Features

The four key features are:

Native OpenTelemetry support
Amazon Linux 2023 base image
Performance improvements
Enhanced security

Native OpenTelemetry support

Native support for OpenTelemetry Protocol (OTLP) has been added, enabling a single Fluent Bit process to ingest and forward logs, metrics, and traces with AWS SigV4 authentication.

This eliminates the need for additional sidecar containers, reducing resource usage and costs.

Amazon Linux 2023 base image

The base image has been upgraded from Amazon Linux 2 to Amazon Linux 2023.

This delivers long-term support until June 30, 2029, with ongoing security patches.

Performance improvements

Faster JSON parsing enables processing more logs per vCPU with lower latency.

Enhanced security

TLS minimum version and cipher controls have been added, which enforce your TLS policy on outputs from AWS for Fluent Bit for stronger protocol posture.

What Changed

The release of AWS for Fluent Bit 3.0.0 significantly transforms container log collection performance.

Let's look at the traditional challenges and the changes brought by the new feature.

Traditional Challenges

There were four main challenges:

Resource consumption by multiple sidecars
Outdated base image approaching end of support
Limited performance
Basic TLS settings only

Resource consumption by multiple sidecars

Collecting OpenTelemetry logs, metrics, and traces required additional sidecar containers such as OpenTelemetry Collector alongside Fluent Bit.

Each sidecar consumed CPU and memory, and in microservices environments, resource costs accumulated across numerous pods and tasks.

Outdated base image approaching end of support

Previous versions used Amazon Linux 2 as the base image, requiring migration planning in anticipation of end of support.

Additionally, being based on Fluent Bit 1.9.10, users couldn't access the latest features and performance improvements.

Limited performance

Traditional JSON parsing had performance limitations when processing large volumes of JSON-formatted logs.

Processing capacity per vCPU was limited, requiring resource scaling in high-traffic environments.

Basic TLS settings only

TLS configuration offered only basic options, without the ability to enforce TLS minimum versions or specify particular cipher suites.

Meeting strict security policies and compliance requirements necessitated additional configuration and workarounds.

Changes with the New Feature

The new version resolves all of these traditional challenges.

### Version and Base image upgrades

Item	2.x Series (Traditional)	3.0.0 (New)
Fluent Bit version	1.9.10	4.10
Base image	Amazon Linux 2	Amazon Linux 2023
Base image support period	June 30, 2026	June 30, 2029
OpenTelemetry support	External Collector required	Native integration
JSON Parsing Performance	Standard	Accelerated
TLS Control	Basic settings only	Version and cipher specification
AWS SigV4 authentication	Manual configuration	Integrated support

Sidecar container reduction

Native OTLP support enables collecting logs, metrics, and traces without additional sidecar containers.

This reduces CPU and memory usage per task or pod, delivering greater cost savings in larger environments.

Long-term support and security

Migration to Amazon Linux 2023 guarantees long-term support until June 30, 2029. Ongoing security patches reduce security risks.

Performance improvements

Accelerated JSON parsing enables processing more logs with the same vCPU resources.

This translates to cost reduction and latency improvements in log-heavy environments.

Granular security controls

TLS minimum version specification (TLSv1.1, TLSv1.2, TLSv1.3) and cipher controls enable enforcing organizational security policy compliance.

Meeting compliance requirements such as PCI DSS and SOC 2 becomes easier.

How to Use

This section provides configuration examples and verification methods for trying the new features of AWS for Fluent Bit 3.0.0.

OpenTelemetry native support example

This example demonstrates leveraging native OTLP support to route OTLP logs from applications to CloudWatch Logs via Fluent Bit.

Creating Fluent Bit additional configuration file

Create a configuration file for Fluent Bit to receive OTLP logs.

1
2
3
4
5
6
7
8
9
10
11
12
[INPUT]
    Name   opentelemetry
    Listen 0.0.0.0
    Port   4318

[OUTPUT]
    Name   cloudwatch_logs
    Match  *
    region ap-northeast-1
    log_group_name /ecs/otlp-logs
    log_stream_prefix otlp
    auto_create_group true

Creating custom docker image

Create a custom Fluent Bit image containing the configuration file.

Creating Dockerfile

1
2
3
4
FROM public.ecr.aws/aws-observability/aws-for-fluent-bit:3.0.0

# Copy configuration file
COPY extra.conf /extra.conf

Building docker image

1
2
3
4
5
# Build Docker image
docker build -t aws-for-fluent-bit-otlp:3.0.0 .

# Verify built image
docker images | grep aws-for-fluent-bit-otlp

Pushing to Amazon ECR

Push the created custom image to Amazon ECR.

Creating ECR repository

1
2
3
aws ecr create-repository \
  --repository-name aws-for-fluent-bit-otlp \
  --region ap-northeast-1

Pushing image

1
2
3
4
5
6
7
8
9
10
11
# Login to ECR
aws ecr get-login-password --region ap-northeast-1 | \
  docker login --username AWS --password-stdin \
  <account-id>.dkr.ecr.ap-northeast-1.amazonaws.com

# Tag image
docker tag aws-for-fluent-bit-otlp:3.0.0 \
  <account-id>.dkr.ecr.ap-northeast-1.amazonaws.com/aws-for-fluent-bit-otlp:3.0.0

# Push
docker push <account-id>.dkr.ecr.ap-northeast-1.amazonaws.com/aws-for-fluent-bit-otlp:3.0.0

Creating task definition

Create a task definition using the custom image.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
{

  "family": "fluent-bit-otlp-custom",

  "networkMode": "awsvpc",

  "requiresCompatibilities": ["FARGATE"],

  "cpu": "1024",

  "memory": "2048",

  "executionRoleArn": "arn:aws:iam::<account-id>:role/ecsTaskExecutionRole",

  "taskRoleArn": "arn:aws:iam::<account-id>:role/ecsTaskRole",

  "containerDefinitions": [

    {

      "name": "log-router",

      "image": "<account-id>.dkr.ecr.ap-northeast-1.amazonaws.com/aws-for-fluent-bit-otlp:3.0.0",

      "essential": true,

      "firelensConfiguration": {

        "type": "fluentbit",

        "options": {

          "config-file-type": "file",

          "config-file-value": "/extra.conf"

        }

      },

      "portMappings": [

        {

          "containerPort": 4318,

          "protocol": "tcp"

        }

      ],

      "logConfiguration": {

        "logDriver": "awslogs",

        "options": {

          "awslogs-group": "/ecs/fluent-bit-otlp",

          "awslogs-region": "ap-northeast-1",

          "awslogs-stream-prefix": "otlp",

          "awslogs-create-group": "true"

        }

      }

    },

    {

      "name": "app",

      "image": "curlimages/curl:latest",

      "essential": false,

      "command": [

        "sh",

        "-c",

        "sleep 20 && while true; do TIMESTAMP=$(date +%s)000000000 && echo \"Sending with timestamp: $TIMESTAMP\" && curl -X POST http://localhost:4318/v1/logs -H 'Content-Type: application/json' --data-raw \"{\\\"resourceLogs\\\":[{\\\"resource\\\":{\\\"attributes\\\":[{\\\"key\\\":\\\"service.name\\\",\\\"value\\\":{\\\"stringValue\\\":\\\"test-service\\\"}}]},\\\"scopeLogs\\\":[{\\\"logRecords\\\":[{\\\"timeUnixNano\\\":\\\"$TIMESTAMP\\\",\\\"severityText\\\":\\\"INFO\\\",\\\"body\\\":{\\\"stringValue\\\":\\\"Test message at $(date)\\\"}}]}]}]}\" && sleep 30; done"

      ],

      "logConfiguration": {

        "logDriver": "awsfirelens",

        "options": {

          "Name": "cloudwatch_logs",

          "region": "ap-northeast-1",

          "log_group_name": "/ecs/app-otlp",

          "log_stream_prefix": "app",

          "auto_create_group": "true"

        }

      }

    }

  ]

}

Creating service

Register the above task definition
Create and deploy a service

Verifying logs

After deploying the task, verify the logs.

Verifying Fluent Bit startup

1
aws logs tail /ecs/fluent-bit-otlp --follow

1
2
[info] [input:opentelemetry:opentelemetry.3] listening on 0.0.0.0:4318
[info] [output:cloudwatch_logs:cloudwatch_logs.0] Creating log stream otlpv1_logs

Verifying OTLP format log data

Open the otlpv1_logs stream in the /ecs/otlp-logs log group in the CloudWatch Logs console to see log data sent in OTLP format.

1
2
3
4
5
6
{
    "log": "Test message at Thu Oct 16 17:03:04 UTC 2025",
    "ecs_cluster": "",
    "ecs_task_arn": "arn:aws:ecs:ap-northeast-1:...",
    "ecs_task_definition": "fluent-bit-otlp-custom:1"
}

You can confirm that OTLP's body.stringValue is automatically converted to the log field, with ECS metadata (cluster, task_arn, task_definition) automatically appended.

Costs and Considerations

This section explains the costs and considerations you should know before using AWS for Fluent Bit 3.0.0.

Pricing

AWS for Fluent Bit 3.0.0 itself is free to use, but charges occur for AWS services where logs are routed.

AWS for Fluent Bit

Container image usage is free
Only standard Amazon ECS and AWS charges apply

CloudWatch Logs

Ingestion: $0.50 / GB (Free tier: 5 GB per month)
Storage: $0.03 / GB / month
Query execution: $0.005 / GB scanned

Other destination services

Amazon S3

Pricing varies by storage class
Standard storage: $0.023/GB/month (Tokyo region)

Amazon Kinesis Data Firehose

$0.029/GB (first 500 TB/month)

Amazon Kinesis Data Streams

Per-shard hourly pricing + PUT payload unit pricing

Cost examples

The following table shows estimated monthly costs by environment size when using CloudWatch Logs in the Tokyo region.

Environment Size	Log Volume / Day	Retention Period	Monthly Cost Estimate
Small	100 MB	7 days	$1 - 2
Medium	1 GB	30 days	$13 - 15
Large	10 GB	30 days	$150+

Cost optimization tips

Set appropriate retention periods (e.g., 30 days for production, 7 days for development)
Measure log volume in non-production environments first
Configure appropriate log levels
Filter unnecessary logs
Leverage Infrequent Access log class

Considerations

Feature limitations

TLS-related parameters are not supported in the cloudwatch_logs output plugin (no configuration needed as CloudWatch Logs API always communicates via HTTPS)
Package manager changed from yum to dnf due to Amazon Linux 2023 base image
Existing configuration verification required due to Fluent Bit major version upgrade

Operational Notes

Verify compatibility before upgrading from 2.x series to 3.0.0
Cost increases from log accumulation occur if CloudWatch Logs retention period is not explicitly set
Verify log format and metadata meet expectations before production deployment

Summary

AWS for Fluent Bit 3.0.0, recently released, is a major update based on Fluent Bit 4.1.0 and Amazon Linux 2023.

Native OpenTelemetry support eliminates the need for additional sidecar containers, and accelerated JSON parsing enables processing more logs with the same resources.

Long-term support is guaranteed until June 30, 2029, and enhanced TLS controls make security policy compliance easier.

With small environments starting at approximately $1~2 per month, we recommend trying it first in a non-production environment.

References

https://aws.amazon.com/about-aws/whats-new/2025/10/aws-fluent-bit-3-0-0-based-4-1-0/ https://github.com/aws/aws-for-fluent-bit

# amazon-ecs # containers # observability

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

AWS for Fluent Bit 3.0.0 Based on Fluent Bit 4.1.0

haruki

Introduction

Feature Overview

Key Features

Native OpenTelemetry support

Amazon Linux 2023 base image

Performance improvements

Enhanced security

What Changed

Traditional Challenges

Resource consumption by multiple sidecars

Outdated base image approaching end of support

Limited performance

Basic TLS settings only

Changes with the New Feature

Sidecar container reduction

Long-term support and security

Performance improvements

Granular security controls

How to Use

OpenTelemetry native support example

Creating Fluent Bit additional configuration file

Creating custom docker image

Creating Dockerfile

Building docker image

Pushing to Amazon ECR

Creating ECR repository

Pushing image

Creating task definition

Creating service

Verifying logs

Verifying Fluent Bit startup

Verifying OTLP format log data

Costs and Considerations

Pricing

AWS for Fluent Bit

CloudWatch Logs

Other destination services

Amazon S3

Amazon Kinesis Data Firehose

Amazon Kinesis Data Streams

Cost examples

Cost optimization tips

Considerations

Feature limitations

Operational Notes

Summary

References