Fluent-bit does not natively support Certificate revocation Checks. I wish to add a new plugin, before the data is actually passed to the server, to make sure that the certificate is not revoked. As per the fluent-bit architecture, it seems like OUTPUT plugins chaining can not be done. I wanted to understand if there is some way to achieve the same.

The following is a sample configuration which has two OUTPUT plugins. I wish to chain the first and second plugins so that in the first plugin , I can check CRL and if not revoked, pass the data to the second OUTPUT plugin which forwards the data to the destination.

Is there some way to achieve this pattern ? Or any other approach to insert a CRL check without modifying the http plugin or fluent-bit code?

# Fluent Bit Input Configuration
[INPUT]
    Name   tail
    Path   /var/log/syslog
    Tag    syslog

# Fluent Bit Output Configuration for CRL Plugin (Example)
[OUTPUT]
    Name    crlplugin
    Match   *
    Address localhost
    PortNo  8443
    rewrite_tag * crlValidated


# Fluent Bit Output Configuration (Sending to HTTPS)
[OUTPUT]
    Name         http
    Match        crlValidated
    Host         localhost
    Port         8443
    TLS          On
    TLS.Verify   Off  # Disable verification of self-signed certificates (if used)
    tls.ca_file  /home/test/client/ca.crt
    tls.crt_file /home/test/client/client.crt
    tls.key_file /home/test/client/client.key
    Format       json