FYI- I figured out my problem above. Turns out it was not fluent-bit at all, but fluentd talking via "forward" protocol to my own fluentd where our routing rules reside.