Hi I am running fluentbit in AWS Firelens using log router E Fluent Community #fluent-bit

Hi, I am running fluentbit in AWS Firelens using l...

Daler

10/30/2025, 3:41 PM

Hi, I am running fluentbit in AWS Firelens using log router ECS container. When deploying the container in ECS, getting the below error.

Copy code

[2025/10/30 14:59:07] [ warn] [config] Read twice. path=/fluent-bit/etc/fluent-bit.conf
[2025/10/30 14:59:07] [error] configuration file contains errors, aborting.

Firelens config setting in container definition

Copy code

"firelensConfiguration" : {
      "type" : "fluentbit",
      "options" : {
        "enable-ecs-log-metadata" : "true",
        "config-file-type" : "file",
        "config-file-value" : "/fluent-bit/etc/fluent-bit-filter.conf"
      }
    }

fluent-bit-filter.conf file

Copy code

[FILTER]
   Name            grep
   Alias           ignore-healthcheck-message
   Match           *
   Logical_Op      and
   Exclude         level INFO
   Exclude         message (?i)(health[-]?check)

[FILTER]
   Name            grep
   Alias           ignore-healthcheck-data
   Match           *
   Logical_Op      and
   Exclude         level INFO
   Exclude         data (?i)(health[-]?check|ELB[-]?HealthChecker)

[FILTER]
   Name            grep
   Alias           ignore-healthchecks-log
   Match           *
   Logical_Op      and
   Exclude         level INFO
   Exclude         log (?i)(health[-]?check|ELB[-]?HealthChecker)

Daler

10/30/2025, 3:42 PM

The same config file works fine in my local terminal when I add Input and Output blocks and used the same docker image to mount the config file.

Daler

10/30/2025, 3:45 PM

I checked the cloudwatch logs but there is not much details except the error I shared.

Daler

10/30/2025, 3:47 PM

@Pat would you kindly suggest what might be wrong in above settings or config, thanks.

Pat

10/31/2025, 12:56 PM

I've no idea, what's your full config - not the AWS stuff as you'll have to ask the AWS folks that directly. I presume you're using the AWS image? What are your full logs and config? It sounds like when you run it however you are there is something going on.

Open in Slack

Previous Next