Fluent Bit Setup

Use Fluent Bit to monitor your web server logs and forward them to Sona for Agent Analytics. This approach tails your Apache or Nginx access logs directly on the server and streams the data to Sona in real time.

Because your access logs already record every request's user agent, Sona can identify AI agents and crawlers (GPTBot, ClaudeBot, PerplexityBot, and more) from the forwarded logs and report which pages they read and how often.

Prerequisites

• A Linux server running Apache or Nginx
• systemctl available (standard on Ubuntu, Debian, CentOS, etc.)
• Your Sona organization UUID

Step 1: Install Fluent Bit

Run the official install script:

curl https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh | sh

Step 2: Configure Fluent Bit

Edit the configuration file:

sudo nano /etc/fluent-bit/fluent-bit.conf

Choose the configuration below that matches your web server.

Option A: Apache + Nginx

[SERVICE]
    Flush     1
    Log_Level info

[INPUT]
    Name   tail
    Path   /var/log/nginx/access.log
    Parser nginx
    Tag    nginx.access

[INPUT]
    Name   tail
    Path   /var/log/apache2/access.log
    Parser apache2
    Tag    apache.access

[OUTPUT]
    Name    http
    Match   *
    Host    api2.sonalabs.com
    Port    443
    URI     /webhooks/fluent-bit/{REPLACE_WITH_YOUR_ORGANIZATION_UUID}/{REPLACE_WITH_YOUR_HOSTNAME}/{SERVER_TIMEZONE}
    Format  json
    TLS     On

Option B: Nginx Only

[SERVICE]
    Flush     1
    Log_Level info

[INPUT]
    Name   tail
    Path   /var/log/nginx/access.log
    Parser nginx
    Tag    nginx.access

[OUTPUT]
    Name    http
    Match   *
    Host    api2.sonalabs.com
    Port    443
    URI     /webhooks/fluent-bit/{REPLACE_WITH_YOUR_ORGANIZATION_UUID}/{REPLACE_WITH_YOUR_HOSTNAME}/{SERVER_TIMEZONE}
    Format  json
    TLS     On

Replace the three placeholders before saving:

Placeholder	Description
{REPLACE_WITH_YOUR_ORGANIZATION_UUID}	Your Sona organization UUID
{REPLACE_WITH_YOUR_HOSTNAME}	Your server's hostname (e.g. mysite.com)
{SERVER_TIMEZONE}	Your server's timezone (e.g. UTC, America/New_York)

Step 3: Enable and Start the Service

sudo systemctl enable fluent-bit
sudo systemctl start fluent-bit

This ensures Fluent Bit starts automatically on reboot and begins forwarding logs immediately.

To verify it's running:

sudo systemctl status fluent-bit