I first asked this on SO but might not have been the right place.
I want to use the Fluent Bit docker image to help me persist the ephemeral docker container logs to a location on my host (and later use it to ship logs elsewhere).
I am facing issues such as: 
    Cannot start service clamav: failed to initialize logging driver: dial tcp 
127.0.0.1:24224: connect: connection refused
I have read a number of post including 
https://stackoverflow.com/questions/55232151/configuring-fluentbit-with-docker but I'm still at a lost.
My docker-compose is made up of nginx, our app, keycloak, elasticsearch and clamav. I have added fluent-bit, made it first to starts via depends on. I changed the other services to use the fluentd logging driver.
Part of config:
    clamav:
      container_name: clamav-app
      image: tiredofit/clamav:latest
      restart: always
      volumes:
        - ./clamav/data:/data
        - ./clamav/logs:/logs
      environment:
        - ZABBIX_HOSTNAME=clamav-app
        - DEFINITIONS_UPDATE_FREQUENCY=60
      networks:
        - iris-network
      expose:
        - "3310"
      depends_on:
        - fluentbit
      logging:
        driver: fluentd
    fluentbit:
      container_name: iris-fluent
      image: fluent/fluent-bit:latest
      restart: always
      networks:
        - iris-network
      volumes:
        - ./fluent-bit/etc:/fluent-bit/etc
      ports:
        - "24224:24224"
        - "24224:24224/udp"
I have tried to proxy_pass 24224 to fluentbit in nginx and start nginx first, and that avoided the error on clamav and es, but same error with keycloak.
So how can I configure the service to use the host or is it that localhost is not the "external" host?