Keep getting CPU metrics even if input source is syslog

[ghost]

I previously used classic, but after trying to use .yaml I keep getting CPU metrics even if input source is syslog.

fluent-bit.yaml (example found from: https://github.com/fluent/fluent-bit-docs/blob/master/pipeline/inputs/syslog.md)

service:
    flush: 1
    parsers_file: parsers.conf
pipeline:
    inputs:
        - name: syslog
          parser: syslog-rfc3164
          listen: 0.0.0.0
          port: 5140
          mode: tcp
    outputs:
        - name: stdout
          match: '*'

docker-compose.yml

  fluentbit:
    image: fluent/fluent-bit:4.0.1
    container_name: fluentbit
    volumes:
      - ./fluent-bit.yaml:/fluent-bit/etc/fluent-bit.yaml
      - ./parsers.yaml:/fluent-bit/etc/parsers.yaml
    ports:
      - "5140:5140"
    networks:
      - opensearch-net

Logs

fluentbit  | [2025/04/30 09:53:32] [ info] [fluent bit] version=4.0.1, commit=b12e507090, pid=1
fluentbit  | [2025/04/30 09:53:32] [ info] [storage] ver=1.5.3, type=memory, sync=normal, checksum=off, max_chunks_up=128
fluentbit  | [2025/04/30 09:53:32] [ info] [simd    ] disabled
fluentbit  | [2025/04/30 09:53:32] [ info] [cmetrics] version=1.0.0
fluentbit  | [2025/04/30 09:53:32] [ info] [ctraces ] version=0.6.4
fluentbit  | [2025/04/30 09:53:32] [ info] [input:cpu:cpu.0] initializing
fluentbit  | [2025/04/30 09:53:32] [ info] [input:cpu:cpu.0] storage_strategy='memory' (memory only)
fluentbit  | [2025/04/30 09:53:32] [ info] [sp] stream processor started
fluentbit  | [2025/04/30 09:53:32] [ info] [output:stdout:stdout.0] worker #0 started
fluentbit  | [0] cpu.local: [[1746006812.651937835, {}], {"cpu_p"=>5.000000, "user_p"=>4.500000, "system_p"=>0.500000, "cpu0.p_cpu"=>9.000000, "cpu0.p_user"=>8.000000, "cpu0.p_system"=>1.000000, "cpu1.p_cpu"=>1.000000, "cpu1.p_user"=>1.000000, "cpu1.p_system"=>0.000000}]
fluentbit  | [0] cpu.local: [[1746006813.652168450, {}], {"cpu_p"=>40.500000, "user_p"=>32.500000, "system_p"=>8.000000, "cpu0.p_cpu"=>38.000000, "cpu0.p_user"=>30.000000, "cpu0.p_system"=>8.000000, "cpu1.p_cpu"=>42.000000, "cpu1.p_user"=>34.000000, "cpu1.p_system"=>8.000000}]
fluentbit  | [0] cpu.local: [[1746006814.652663545, {}], {"cpu_p"=>51.000000, "user_p"=>39.500000, "system_p"=>11.500000, "cpu0.p_cpu"=>52.0000

Just for context, doing the following works (which I also found from https://github.com/fluent/fluent-bit-docs/blob/master/pipeline/inputs/syslog.md)

[SERVICE]
    Flush        1
    Parsers_File parsers.conf

[INPUT]
    Name     syslog
    Parser   syslog-rfc3164
    Listen   0.0.0.0
    Port     5140
    Mode     tcp

[OUTPUT]
    Name     stdout
    Match    *

Could someone help me understand why this is happening?

[patrick-stephens]

You've not told it to use your actual config file, by default the container image will attempt to use -c /fluent-bit/etc/fluent-bit.conf:

fluent-bit/dockerfiles/Dockerfile

Line 208 in 5905ddc

CMD ["/fluent-bit/bin/fluent-bit", "-c", "/fluent-bit/etc/fluent-bit.conf"]

You need to tell it to use your config file by overriding those defaults to specify -c <filename>.

[ghost]

Thank you