diff --git a/observability/audit-log-collector-configmap.yaml b/observability/audit-log-collector-configmap.yaml
new file mode 100644
index 0000000..669a20e
--- /dev/null
+++ b/observability/audit-log-collector-configmap.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: audit-log-collector-config
+  namespace: observability
+data:
+  fluent-bit.conf: |
+    [SERVICE]
+        Flush        1
+        Log_Level    info
+
+    [INPUT]
+        Name         http
+        Listen       0.0.0.0
+        Port         8888
+
+    [OUTPUT]
+        Name         file
+        Match        *
+        Path         /data
+        File         audit.jsonl
+        Format       plain
diff --git a/observability/audit-log-collector-deployment.yaml b/observability/audit-log-collector-deployment.yaml
new file mode 100644
index 0000000..bcac06b
--- /dev/null
+++ b/observability/audit-log-collector-deployment.yaml
@@ -0,0 +1,33 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: audit-log-collector
+  namespace: observability
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: audit-log-collector
+  template:
+    metadata:
+      labels:
+        app: audit-log-collector
+    spec:
+      containers:
+        - name: fluent-bit
+          image: fluent/fluent-bit:3.2
+          ports:
+            - containerPort: 8888
+          volumeMounts:
+            - name: config
+              mountPath: /fluent-bit/etc/fluent-bit.conf
+              subPath: fluent-bit.conf
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: config
+          configMap:
+            name: audit-log-collector-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: audit-log-collector-data
diff --git a/observability/audit-log-collector-pvc.yaml b/observability/audit-log-collector-pvc.yaml
new file mode 100644
index 0000000..c834961
--- /dev/null
+++ b/observability/audit-log-collector-pvc.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: audit-log-collector-data
+  namespace: observability
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/observability/audit-log-collector-service.yaml b/observability/audit-log-collector-service.yaml
new file mode 100644
index 0000000..a21b8f7
--- /dev/null
+++ b/observability/audit-log-collector-service.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: audit-log-collector
+  namespace: observability
+spec:
+  selector:
+    app: audit-log-collector
+  ports:
+    - port: 80
+      targetPort: 8888