Loading...

Type: Bug
Resolution: Done
Priority: Major
Fix Version/s: Logging 5.5.0
Affects Version/s: Logging 5.3.2, Logging 5.2.5, Logging 5.1.6
Component/s: Log Collection
Labels:
- devel_ack+
- rn-done-resolved

Blocked:
False
Ready:
False
Docs QE Status:
NEW
QE Status:
VERIFIED
Release Note Text:

Hide
Before this change, enabling structured logging would forward infrastructure logs to application indices when there was a matching structured key for the infrastructure pod. This fixes the issue by always forwarding infrastructure logs to the infrastructure index.

Show
Before this change, enabling structured logging would forward infrastructure logs to application indices when there was a matching structured key for the infrastructure pod. This fixes the issue by always forwarding infrastructure logs to the infrastructure index.
Market:

Sprint:
Logging (Core) - Sprint 213, Logging (Core) - Sprint 214, Logging (Core) - Sprint 215, Logging (Core) - Sprint 216, Logging (Core) - Sprint 218, Logging (Core) - Sprint 219

SFDC Cases Links:
SFDC Cases Counter:
SFDC Cases Open:

Description of problem:
The infra logs are sent to app-xx indices when Structured Logs is enabled.

$oc exec -c elasticsearch elasticsearch-cdm-gvpuj7cg-1-7774cf55f9-tcp8k – es_util --query=_cat/shards
app-json-pod-log-000001  0 p STARTED   3708   1.9mb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
infra-000001             0 p STARTED 458235 335.5mb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
app-multus-000001        0 p STARTED      6  80.2kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
app-etcd-000001          0 p STARTED    848 766.9kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
app-etcd-operator-000001 0 p STARTED    100  91.8kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
app-installer-000001     0 p STARTED     30 474.8kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
app-olm-operator-000001  0 p STARTED    655 770.1kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
audit-000001             0 p STARTED  15308  13.8mb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
.kibana_1                0 p STARTED      0    230b 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
app-000001               0 p STARTED     51    43kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
.security                0 p STARTED      6  32.7kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1

How reproducible: Always

Step to reproduce:
1) Create CLF as below:

{
    "apiVersion": "logging.openshift.io/v1",
    "kind": "ClusterLogForwarder",
    "metadata": {
        "name": "instance",
        "namespace": "openshift-logging"
    },
    "spec": {
        "outputDefaults": {
            "elasticsearch": {
                "structuredTypeKey": "kubernetes.labels.app",
                "structuredTypeName": "json-pod-log"
            }
        },
        "pipelines": [
            {
                "inputRefs": [
                    "audit",
                    "application",
                    "infrastructure"
                ],
                "name": "structuredenabled",
                "outputRefs": [
                    "default"
                ],
                "parse": "json"
            }
        ]
    }
}