ENV

$ oc get csv
NAME                              DISPLAY                            VERSION    REPLACES                          PHASE
cluster-logging.5.3.0-55          Red Hat OpenShift Logging          5.3.0-55   cluster-logging.5.2.3-31          Succeeded
elasticsearch-operator.5.3.0-67   OpenShift Elasticsearch Operator   5.3.0-67   elasticsearch-operator.5.2.3-31   Succeeded

ISSUE

Having a ClusterLogForwarder configuration like this:

spec:
  outputDefaults:
    elasticsearch:
      structuredTypeKey: kubernetes.labels.app
      structuredTypeName: nologformat
  outputs:
  - name: external-elasticsearch
    secret:
      name: log-forwarder-secret
    type: elasticsearch
    url: https://elasticsearch.example.com:443
  pipelines:
  - inputRefs:
    - application
    name: application-logs
    outputRefs:
    - external-elasticsearch
    parse: json

Then fluentd config generated is like this:

$ oc get cm collector -o json | jq '.data."fluent.conf"' -r

...

  <match **>
    @type elasticsearch
    @id external_elasticsearch
    host elasticsearch.example.com
    port 443
    verify_es_version_at_startup false
    scheme https
    ssl_version TLSv1_2
    client_key '/var/run/ocp-collector/secrets/collector/tls.key'
    client_cert '/var/run/ocp-collector/secrets/collector/tls.crt'
    ca_file '/var/run/ocp-collector/secrets/collector/ca-bundle.crt'
    target_index_key viaq_index_name

Where it's visible that the `client_key`, `client_cert` and `ca_file` are wrong.

This only happens when you define in the CLF this section:

  outputDefaults:
    elasticsearch:
      structuredTypeKey: kubernetes.labels.app
      structuredTypeName: nologformat

If the CLF instance definition is like this:

spec:
  outputs:
  - name: external-elasticsearch
    secret:
      name: log-forwarder-secret
    type: elasticsearch
    url: https://elasticsearch.example.com:443
  pipelines:
  - inputRefs:
    - application
    name: application-logs
    outputRefs:
    - external-elasticsearch
    parse: json

The fluentd config generated is correct.