An agent (Fluent Bit, Vector, Filebeat) that collects logs from each host and forwards them to a central aggregator.
A log shipper is the agent that runs on each host (or as a sidecar in each pod) and forwards logs to a central aggregator. Common shippers include Fluent Bit, Fluentd, Vector, Filebeat, and Promtail. The shipper handles batching, compression, retries, parsing of unstructured lines into structured fields, redaction of secrets, and routing to one or more destinations. A poorly-configured shipper can drop logs silently during high traffic, miss the very incident the team is trying to investigate.
The reliability of an observability stack is bounded by the reliability of its log shipper. Most 'we had no logs from the failing service' stories trace to a shipper that ran out of buffer, fell behind, or crashed because it couldn't connect to the destination. Treat the shipper as a critical service: monitor its drop rate, its lag, and its CPU, just like any other production component.
See the part of the platform that handles log shipper in production.