diff --git a/hieradata/site/dev.yaml b/hieradata/site/dev.yaml
index 380a63d501..fd72f48ba7 100644
--- a/hieradata/site/dev.yaml
+++ b/hieradata/site/dev.yaml
@@ -13,6 +13,16 @@ rsyslog::config::actions:
       StreamDriver: "ossl"
       StreamDriverMode: "1"
       StreamDriverAuthMode: "anon"
+  fluentbit_ruka:
+    type: "omfwd"
+    facility: "*.*"
+    config:
+      target: "rsyslog.fluent.ruka.dev.lsst.org"
+      port: 5140
+      protocol: "tcp"
+      StreamDriver: "ossl"
+      StreamDriverMode: "1"
+      StreamDriverAuthMode: "anon"
 # The following keys are shared between the `dhcp` and `resolv_conf` classes:
 # - dhcp::dnsdomain
 # - dhcp::nameservers
diff --git a/spec/support/spec/rsyslog.rb b/spec/support/spec/rsyslog.rb
index 2505045140..f728736a3c 100644
--- a/spec/support/spec/rsyslog.rb
+++ b/spec/support/spec/rsyslog.rb
@@ -116,6 +116,21 @@
         },
       )
     end
+
+    it do
+      is_expected.to contain_rsyslog__component__action('fluentbit_ruka').with(
+        type: 'omfwd',
+        facility: '*.*',
+        config: {
+          'target' => 'rsyslog.fluent.ruka.dev.lsst.org',
+          'port' => '5140',
+          'protocol' => 'tcp',
+          'StreamDriver' => 'ossl',
+          'StreamDriverMode' => '1',
+          'StreamDriverAuthMode' => 'anon',
+        },
+      )
+    end
   when 'tu'
     it do
       is_expected.to contain_rsyslog__component__action('graylogtu').with(