diff --git a/hieradata/site/dev.yaml b/hieradata/site/dev.yaml
index 83f53dbe70..2729e91eea 100644
--- a/hieradata/site/dev.yaml
+++ b/hieradata/site/dev.yaml
@@ -2,16 +2,20 @@
 ipa::ipa_master_fqdn: "ipa1.ls.lsst.org"
 rsyslog::feature_packages:
   - "rsyslog-elasticsearch"
+  - "rsyslog-openssl"
 rsyslog::config::modules:
   omelasticsearch: {}
 rsyslog::config::actions:
-  graylogls:
+  fluentbit_dev:
     type: "omfwd"
     facility: "*.*"
     config:
-      Target: "collector.ls.lsst.org"
-      Port: 5514
-      Protocol: "udp"
+      target: "rsyslog.fluent.ayekan.dev.lsst.org"
+      port: 5140
+      protocol: "tcp"
+      StreamDriver: "ossl"
+      StreamDriverMode: "1"
+      StreamDriverAuthMode: "anon"
   opensearch:
     type: "omelasticsearch"
     facility: "*.*"
diff --git a/spec/support/spec/rsyslog.rb b/spec/support/spec/rsyslog.rb
index 92ba2f5aac..3de28d51cc 100644
--- a/spec/support/spec/rsyslog.rb
+++ b/spec/support/spec/rsyslog.rb
@@ -101,16 +101,20 @@
     end
   when 'dev'
     it { is_expected.to contain_package('rsyslog-elasticsearch') }
+    it { is_expected.to contain_package('rsyslog-openssl') }
     it { is_expected.to contain_rsyslog__component__module('omelasticsearch') }
 
     it do
-      is_expected.to contain_rsyslog__component__action('graylogls').with(
+      is_expected.to contain_rsyslog__component__action('fluentbit_dev').with(
         type: 'omfwd',
         facility: '*.*',
         config: {
-          'Target' => 'collector.ls.lsst.org',
-          'Port' => '5514',
-          'Protocol' => 'udp',
+          'target' => 'rsyslog.fluent.ayekan.dev.lsst.org',
+          'port' => '5140',
+          'protocol' => 'tcp',
+          'StreamDriver' => 'ossl',
+          'StreamDriverMode' => '1',
+          'StreamDriverAuthMode' => 'anon',
         },
       )
     end