Fluentd vs Logstash: Which Log Collector?
Fluentd is a lightweight, CNCF log collector with a huge plugin set; Logstash is the heavier, powerful processing stage of the Elastic Stack.
Fluentd is a CNCF-graduated, resource-light log collector and router with hundreds of plugins, popular in Kubernetes (often as Fluent Bit). Logstash is the ingest-and-transform component of the Elastic Stack with rich filter capabilities, but a heavier JVM footprint. Both collect, parse, and forward logs to destinations like Elasticsearch.
| Fluentd | Logstash | |
|---|---|---|
| Footprint | Light (Fluent Bit lighter still) | Heavier (JVM) |
| Ecosystem | CNCF, many plugins | Elastic Stack |
| Processing power | Good | Very rich filters |
| Kubernetes fit | Excellent | Workable |
| Best for | Cloud-native, low overhead | Elastic-centric, heavy transforms |
In practice
Fluentd (or Fluent Bit) is the common choice in Kubernetes and resource-constrained environments - light, CNCF-native, plugin-rich. Logstash fits when you are all-in on Elastic and need its powerful filter and transformation capabilities. You can also pair Fluent Bit for collection with Logstash or Elasticsearch ingest pipelines for processing.
Note
Either can ship CI and build logs to your backend. Builds run on CI runners; faster managed runners shorten them.
The verdict
Want a lightweight, cloud-native, CNCF collector: Fluentd / Fluent Bit. All-in on Elastic with heavy transform needs: Logstash. Pick by footprint and how Elastic-centric your stack is.