Merge branch 'master' into lynettemiles/sc-136256/update-fluent-bit-docs-pipeline-outputs-opensear

Signed-off-by: Lynette  Miles <[email protected]>

Author: esmerel

administration/configuring-fluent-bit/yaml/service-section.md

@@ -73,9 +73,13 @@ plugin issues a retry.
 
 ### Listener backlog
 
-When Fluent Bit listens for incoming connections (for example, in input plugins like HTTP, TCP, OpenTelemetry, Forward, Syslog, etc.), the operating system maintains a queue of pending connections. The `net.backlog` option controls the maximum number of pending connections that can be queued before new connection attempts are refused. Increasing this value can help Fluent Bit handle bursts of incoming connections more gracefully. The default value is `128`.
+When Fluent Bit listens for incoming connections (for example, in input plugins like HTTP, TCP, OpenTelemetry, Forward, and Syslog), the operating system maintains a queue of pending connections. The `net.backlog` option controls the maximum number of pending connections that can be queued before new connection attempts are refused. Increasing this value can help Fluent Bit handle bursts of incoming connections more gracefully. The default value is `128`.
 
-> **Note:** On Linux, the effective backlog value may be capped by the kernel parameter `net.core.somaxconn`. If you need to allow a higher number of pending connections, you may need to increase this system setting.
+{% hint style="info" %}
+
+On Linux, the effective backlog value might be capped by the kernel parameter `net.core.somaxconn`. If you need to allow a greater number of pending connections, you can increase this system setting.
+
+{% endhint %}
 
 ## Configuration options
 
@@ -95,7 +99,7 @@ that rely on networking I/O:
 | `net.keepalive_max_recycle` | Set maximum number of times a keepalive connection can be used before it's retired. | `2000` |
 | `net.max_worker_connections` | Set maximum number of TCP connections that can be established per worker. | `0` (unlimited) |
 | `net.source_address` | Specify network address to bind for data traffic. | _none_ |
-| `net.backlog` | Set the maximum number of pending connections for listening sockets. This option is vailable on versions >= 4.0.4. | `128` |
+| `net.backlog` | Set the maximum number of pending connections for listening sockets. This option requires Fluent Bit version 4.0.4 or later. | `128` |
 
 ## Example
 
@@ -183,4 +187,4 @@ If the `net.keepalive` option isn't enabled, Fluent Bit closes the TCP connectio
 and netcat quits.
 
 After the five records arrive, the connection idles. After 10 seconds, the connection
-closes due to `net.keepalive_idle_timeout`.
+closes due to `net.keepalive_idle_timeout`.

administration/networking.md

@@ -30,7 +30,7 @@ Follow the official
 [Debian wiki guidance](https://wiki.debian.org/DebianRepository/UseThirdParty#OpenPGP_Key_distribution).
 
 ```bash copy
-curl https://packages.fluentbit.io/fluentbit.key | gpg --dearmor > /usr/share/keyrings/fluentbit-keyring.gpg
+sudo sh -c 'curl https://packages.fluentbit.io/fluentbit.key | gpg --dearmor > /usr/share/keyrings/fluentbit-keyring.gpg'
 ```
 
 ### Updated key from March 2022
@@ -61,10 +61,10 @@ which platforms are supported in each release.
 ## Update your sources lists
 
 For Debian, you must add the Fluent Bit APT server entry to your sources lists.
-Add the following content at bottom of your `/etc/apt/sources.list` file.
+
 
 ```bash copy
-deb [signed-by=/usr/share/keyrings/fluentbit-keyring.gpg] https://packages.fluentbit.io/debian/${CODENAME} ${CODENAME} main
+echo "deb [signed-by=/usr/share/keyrings/fluentbit-keyring.gpg] https://packages.fluentbit.io/ubuntu/${CODENAME} ${CODENAME} main" | sudo tee /etc/apt/sources.list.d/fluent-bit.list
 ```
 
 Replace _`CODENAME`_ with your specific

installation/linux/debian.md

@@ -14,7 +14,7 @@ The first step is to add the Fluent Bit server GPG key to your keyring so you
 can get FLuent Bit signed packages:
 
 ```shell
-curl https://packages.fluentbit.io/fluentbit.key | sudo apt-key add -
+sudo sh -c 'curl https://packages.fluentbit.io/fluentbit.key | sudo apt-key add - '
 ```
 
 ### Updated key from March 2022
@@ -52,19 +52,19 @@ Add the following content at bottom of your `/etc/apt/sources.list` file.
 ### Raspbian 12 (Bookworm)
 
 ```text
-deb https://packages.fluentbit.io/raspbian/bookworm bookworm main
+echo "deb https://packages.fluentbit.io/raspbian/bookworm bookworm main" | sudo tee /etc/apt/sources.list.d/fluent-bit.list
 ```
 
 ### Raspbian 11 (Bullseye)
 
 ```text
-deb https://packages.fluentbit.io/raspbian/bullseye bullseye main
+echo "deb https://packages.fluentbit.io/raspbian/bullseye bullseye main" | sudo tee /etc/apt/sources.list.d/fluent-bit.list
 ```
 
 ### Raspbian 10 (Buster)
 
 ```text
-deb https://packages.fluentbit.io/raspbian/buster buster main
+echo "deb https://packages.fluentbit.io/raspbian/buster buster main" | sudo tee /etc/apt/sources.list.d/fluent-bit.list
 ```
 
 ### Update your repositories database

installation/linux/raspbian-raspberry-pi.md

@@ -25,7 +25,7 @@ Follow the official
 [Debian wiki guidance](https://wiki.debian.org/DebianRepository/UseThirdParty#OpenPGP_Key_distribution).
 
 ```bash
-curl https://packages.fluentbit.io/fluentbit.key | gpg --dearmor > /usr/share/keyrings/fluentbit-keyring.gpg
+sudo sh -c 'curl https://packages.fluentbit.io/fluentbit.key | gpg --dearmor > /usr/share/keyrings/fluentbit-keyring.gpg'
 ```
 
 ### Updated key from March 2022
@@ -56,12 +56,11 @@ which platforms are supported in each release.
 ## Update your sources lists
 
 On Ubuntu, you need to add the Fluent Bit APT server entry to your sources lists.
-Add the following content at bottom of your `/etc/apt/sources.list` file. Ensure
-`CODENAME` is set to your specific [Ubuntu release name](https://wiki.ubuntu.com/Releases).
+Ensure `CODENAME` is set to your specific [Ubuntu release name](https://wiki.ubuntu.com/Releases).
 For example, `focal` for Ubuntu 20.04.
 
 ```bash
-deb [signed-by=/usr/share/keyrings/fluentbit-keyring.gpg] https://packages.fluentbit.io/ubuntu/${CODENAME} ${CODENAME} main
+echo "deb [signed-by=/usr/share/keyrings/fluentbit-keyring.gpg] https://packages.fluentbit.io/ubuntu/${CODENAME} ${CODENAME} main" | sudo tee /etc/apt/sources.list.d/fluent-bit.list
 ```
 
 ### Update your repositories database

installation/linux/ubuntu.md

@@ -99,15 +99,15 @@ function cb_print(tag, timestamp, record)
 end
 ```
 
-#### Function arguments
+### Function arguments
 
 | Name | Description |
 | ---- | ----------- |
 | `tag` | Name of the tag associated with the incoming record. |
 | `timestamp` | Unix timestamp with nanoseconds associated with the incoming record. The original format is a double (`seconds.nanoseconds`). |
 | `record` | Lua table with the record content. |
 
-#### Return values
+### Return values
 
 Each callback must return three values:
 
@@ -117,13 +117,13 @@ Each callback must return three values:
 | `timestamp` | double | If `code` equals `1`, the original record timestamp will be replaced with this new value. |
 | `record` | table | If `code` equals `1`, the original record information will be replaced with this new value. The `record` value must be a valid Lua table. This value can be an array of tables (for example, an array of objects in JSON format), and in that case the input record is effectively split into multiple records. |
 
-## Lua Extended callback with Groups and Metadata support
+## Lua extended callback with groups and metadata support
 
 {% hint style="info" %}
-This feature is available in Fluent Bit version 4.0.4 and later.
+This feature requires Fluent Bit version 4.0.4 or later.
 {% endhint %}
 
-For more advanced use cases, especially when working with structured formats like OpenTelemetry Logs, Fluent Bit supports an extended callback prototype that provides access to group metadata and record metadata.
+For more advanced use cases, especially when working with structured formats like OpenTelemetry logs, Fluent Bit supports an extended callback prototype that provides access to group metadata and record metadata.
 
 ### Extended function signature
 
@@ -140,8 +140,8 @@ end
 | ---- | ----------- |
 | `tag` | Name of the tag associated with the incoming record. |
 | `timestamp` | Unix timestamp with nanoseconds associated with the incoming record. |
-| `group` | A read-only table containing group-level metadata (e.g., OpenTelemetry resource or scope info). This will be an empty table if the log is not part of a group. |
-| `metadata` | A table representing the record-specific metadata. You may modify this if needed. |
+| `group` | A read-only table containing group-level metadata (for example, OpenTelemetry resource or scope info). This will be an empty table if the log is not part of a group. |
+| `metadata` | A table representing the record-specific metadata. You can modify this if needed. |
 | `record` | Lua table with the record content. |
 
 #### Extended return values
@@ -159,8 +159,8 @@ Each extended callback must return four values:
 
 At load time, the Lua filter automatically detects which callback prototype to use based on the number of parameters:
 
-- **3 arguments**: Uses the classic mode (`tag`, `timestamp`, `record`)
-- **5 arguments**: Uses the metadata-aware mode (`tag`, `timestamp`, `group`, `metadata`, `record`)
+- Three arguments: Uses the classic mode (`tag`, `timestamp`, `record`)
+- Five arguments: Uses the metadata-aware mode (`tag`, `timestamp`, `group`, `metadata`, `record`)
 
 This ensures backward compatibility with existing Lua scripts.
 
@@ -182,7 +182,11 @@ function cb_metadata(tag, ts, group, metadata, record)
 end
 ```
 
-> **Note:** The metadata and record arrays must have the same length.
+{% hint style="info" %}
+
+The metadata and record arrays must have the same length.
+
+{% endhint %}
 
 ### OpenTelemetry example
 
@@ -262,7 +266,11 @@ pipeline:
 }
 ```
 
-> **Important:** Group metadata is read-only and should not be modified. If you don't need group or metadata support, you can continue using the 3-argument prototype.
+{% hint style="info" %}
+
+Group metadata is read-only and should not be modified. If you don't need group or metadata support, you can continue using the three-argument prototype.
+
+{% endhint %}
 
 ## Features
 
@@ -791,4 +799,4 @@ pipeline:
 
 ```text
 test: [[1731990257.781970977, {}], {"my_env"=>{"A"=>"aaa", "C"=>"ccc", "HOSTNAME"=>"monox-2.lan", "B"=>"bbb"}, "rand_value"=>4805047635809401856}]
-```
+```

pipeline/filters/lua.md

@@ -42,37 +42,38 @@ The plugin supports the following configuration parameters:
 
 The Tail plugin uses buffers to efficiently read and process log files. Understanding how these buffers work helps optimize memory usage and performance.
 
-### File buffers vs Fluent Bit chunks
+### File buffers versus Fluent Bit chunks
 
-When a file is opened for monitoring, the Tail plugin allocates a buffer in memory of `buffer_chunk_size` bytes (defaults to 32KB). This buffer is used to read data from the file. If a single record (line) is longer than `buffer_chunk_size`, the buffer will grow up to `buffer_max_size` to accommodate it.
+When a file is opened for monitoring, the Tail plugin allocates a buffer in memory of `buffer_chunk_size` bytes (defaults to 32 KB). This buffer is used to read data from the file. If a single record (line) is longer than `buffer_chunk_size`, the buffer will grow up to `buffer_max_size` to accommodate it.
 
-> **Note:** These buffers are per-file. If you're monitoring many files, each file gets its own buffer, which can significantly increase memory usage.
+{% hint style="info" %}
+
+These buffers are per-file. If you're monitoring many files, each file gets its own buffer, which can significantly increase memory usage.
+
+{% endhint %}
 
 ### From buffers to chunks
 
-Inside each file buffer, multiple lines/records might exist. The plugin processes these records and converts them to msgpack format (binary serialization). This msgpack data is then appended to what Fluent Bit calls a **Chunk** - a collection of serialized records that belong to the same tag.
+Inside each file buffer, multiple lines or records might exist. The plugin processes these records and converts them to MessagePack format (binary serialization). This MessagePack data is then appended to what Fluent Bit calls a _chunk_, which is a collection of serialized records that belong to the same tag.
 
-While Fluent Bit has a soft limit of 2MB for chunks, input plugins like Tail can generate msgpack buffers larger than 2MB, and the final chunk can exceed this soft limit.
+Although Fluent Bit has a soft limit of 2 MB for chunks, input plugins like Tail can generate MessagePack buffers larger than 2 MB, and the final chunk can exceed this soft limit.
 
 ### Memory protection with `mem_buf_limit`
 
-If Fluent Bit is not configured to use filesystem buffering, it needs mechanisms to protect against high memory consumption during backpressure scenarios (e.g., when destination endpoints are down or network issues occur). The `mem_buf_limit` option restricts how much memory in chunks an input plugin can use.
+If Fluent Bit is not configured to use filesystem buffering, it needs mechanisms to protect against high memory consumption during backpressure scenarios (for example, when destination endpoints are down or network issues occur). The `mem_buf_limit` option restricts how much memory in chunks an input plugin can use.
 
 When filesystem buffering is enabled, memory management works differently. For more details, see [Buffering and Storage](../../administration/buffering-and-storage.md).
 
 ## Database file
 
-{% hint style="info" %}
-**File positioning behavior:**
+File positioning behavior varies based on the presence or absence of a database file.
 
-- **With database file**: The plugin restores the last known position (offset) from the database. If no previous position exists and `read_from_head` is false, it starts monitoring from the end of the file.
+If a database file is present, the plugin restores the last known position (offset) from the database. If no previous position exists and `read_from_head` is `false`, it starts monitoring from the end of the file.
 
-- **Without database file**:
-  - If `read_from_head` is true: The plugin reads from the beginning of the file
-  - If `read_from_head` is false: The plugin starts monitoring from the end of the file (classic "tail" behavior)
+If no database file is present, positioning behavior depends on the value of `read_from_head`:
 
-This means that without a database and with `read_from_head` set to false, only new content written after Fluent Bit starts will be monitored.
-{% endhint %}
+- When `read_from_head` is `true`, the plugin reads from the beginning of the file.
+- When `read_from_head` is `false`, the plugin starts monitoring from the end of the file (classic "tail" behavior). This means that only new content written after Fluent Bit starts will be monitored.
 
 ## Monitor a large number of files
 
@@ -128,12 +129,12 @@ systemctl edit fluent-bit.service
 
 Fluent Bit 1.8 and later supports multiline core capabilities for the Tail input plugin. Fluent Bit supports the both the old and new configuration mechanisms. To avoid breaking changes, users are encouraged to use the latest one. The two mechanisms are:
 
-- Multiline Core
-- Old Multiline
+- Multiline core
+- Old multiline
 
-### Multiline Core
+### Multiline core
 
-The new multiline core is exposed by the following configuration:
+Multiline core is exposed by the following configuration:
 
 | Key                | Description                                                                                                                                       |
 |:-------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------|