-
Bug
-
Resolution: Done
-
Major
-
Logging 5.3.2, Logging 5.2.5, Logging 5.1.6
-
False
-
False
-
NEW
-
NEW
-
-
Logging (Core) - Sprint 219, Logging (Core) - Sprint 220
Description of problem:
The infra logs are sent to app-xx indices when Structured Logs is enabled.
$oc exec -c elasticsearch elasticsearch-cdm-gvpuj7cg-1-7774cf55f9-tcp8k – es_util --query=_cat/shards app-json-pod-log-000001 0 p STARTED 3708 1.9mb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1 infra-000001 0 p STARTED 458235 335.5mb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1 app-multus-000001 0 p STARTED 6 80.2kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1 app-etcd-000001 0 p STARTED 848 766.9kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1 app-etcd-operator-000001 0 p STARTED 100 91.8kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1 app-installer-000001 0 p STARTED 30 474.8kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1 app-olm-operator-000001 0 p STARTED 655 770.1kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1 audit-000001 0 p STARTED 15308 13.8mb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1 .kibana_1 0 p STARTED 0 230b 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1 app-000001 0 p STARTED 51 43kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1 .security 0 p STARTED 6 32.7kb 10.128.2.47 elasticsearch-cdm-gvpuj7cg-1
How reproducible: Always
Step to reproduce:
1) Create CLF as below:
{
"apiVersion": "logging.openshift.io/v1",
"kind": "ClusterLogForwarder",
"metadata": {
"name": "instance",
"namespace": "openshift-logging"
},
"spec": {
"outputDefaults": {
"elasticsearch": {
"structuredTypeKey": "kubernetes.labels.app",
"structuredTypeName": "json-pod-log"
}
},
"pipelines": [
{
"inputRefs": [
"audit",
"application",
"infrastructure"
],
"name": "structuredenabled",
"outputRefs": [
"default"
],
"parse": "json"
}
]
}
}
