In our case we're still using fluentd v1.13, which does not support Heartbeat, and by default banzaicloud's fluentd (v1.14) has heartbeat enabled over UDP for the port, so we had to disable that. No TLS in our instance either, but the

buffer:

section is the important piece. This enforces flushing every 5 seconds for near-realtime routing of the logs.