Not sure where the best place is to make this post. Forgive me if /r/splunk isn't right (/r/fluentbit looks dead).

I'm experimenting with Fluent-Bit as a tool to ingest logs into Splunk. The goal is to leverage Fluent-Bit within a Docker Container.

I have a sample config running on a server (purely for experimentation). And I'm trying to forward the request logs to an HTTP Event Collector. However I'm running into an error on the server:

start request repeated too quickly for fluent-bit.service
Failed to start Fluent Bit.

Fluent Bit is attempting to start. But it's running into SystemD's service restart limitations (count is 5). My Fluent Bit config looks like this, not sure if there is an error with the Fluent Bit config that's causing this:

[INPUT]
    Name                        tail
    Tag                         SystemMessages
    path                        /var/log/messages
    Read_from_Head              True

[OUTPUT]
    Name                        splunk
    Match                       SystemMessages
    Host                        192.168.110.122
    Port                        8088
    Splunk_Token                x-x-x-x-c1986d3644ae
    event_sourcetype            test_sourcetype
    event_index                 main
    TLS                         on
    TLS.Verify                  off
    Splunk_Send_Raw             off

Out of habit I've intentionally obscured the Splunk_Token. If you're curious why Fluent Bit, we have a lot of logs and log sources coming from different systems across the network. Some of which might not be adequate for a Universal Forwarder (like a docker container). And I'm looking at Fluent Bit as an alternative to the UF.

Thank you for your help.