Fluent Bit Setup

Use Fluent Bit to monitor your web server logs and forward them to Sona for server-side analytics. This approach tails your Apache or Nginx access logs directly on the server and streams the data to Sona in real time.

Prerequisites

• A Linux server running Apache or Nginx
• systemctl available (standard on Ubuntu, Debian, CentOS, etc.)
• Your Sona organization UUID

Step 1: Install Fluent Bit

Run the official install script:

curl https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh | sh

Step 2: Configure Fluent Bit

Edit the configuration file:

sudo nano /etc/fluent-bit/fluent-bit.conf

Choose the configuration below that matches your web server.

Option A: Apache + Nginx

[SERVICE]
    Flush     1
    Log_Level info

[INPUT]
    Name   tail
    Path   /var/log/nginx/access.log
    Parser nginx
    Tag    nginx.access

[INPUT]
    Name   tail
    Path   /var/log/apache2/access.log
    Parser apache2
    Tag    apache.access

[OUTPUT]
    Name    http
    Match   *
    Host    api2.sonalabs.com
    Port    443
    URI     /webhooks/fluent-bit/{REPLACE_WITH_YOUR_ORGANIZATION_UUID}/{REPLACE_WITH_YOUR_HOSTNAME}/{SERVER_TIMEZONE}
    Format  json
    TLS     On

Option B: Nginx Only

[SERVICE]
    Flush     1
    Log_Level info

[INPUT]
    Name   tail
    Path   /var/log/nginx/access.log
    Parser nginx
    Tag    nginx.access

[OUTPUT]
    Name    http
    Match   *
    Host    api2.sonalabs.com
    Port    443
    URI     /webhooks/fluent-bit/{REPLACE_WITH_YOUR_ORGANIZATION_UUID}/{REPLACE_WITH_YOUR_HOSTNAME}/{SERVER_TIMEZONE}
    Format  json
    TLS     On

Replace the three placeholders before saving:

Placeholder	Description
{REPLACE_WITH_YOUR_ORGANIZATION_UUID}	Your Sona organization UUID
{REPLACE_WITH_YOUR_HOSTNAME}	Your server's hostname (e.g. mysite.com)
{SERVER_TIMEZONE}	Your server's timezone (e.g. UTC, America/New_York)

Step 3: Enable and Start the Service

sudo systemctl enable fluent-bit
sudo systemctl start fluent-bit

This ensures Fluent Bit starts automatically on reboot and begins forwarding logs immediately.

To verify it's running:

sudo systemctl status fluent-bit