$ oc logs -c collector collector-cwbfh
Setting each total_size_limit for 3 buffers to 5341287833 bytes
Setting queued_chunks_limit_size for each buffer to 636
Setting chunk_limit_size for each buffer to 8388608
/var/lib/fluentd/pos/journal_pos.json exists, checking if yajl parser able to parse this json file without any error.
ruby 2.5.9p229 (2021-04-05 revision 67939) [x86_64-linux]
checking if /var/lib/fluentd/pos/journal_pos.json a valid json by calling yajl parser
2022-06-03 08:00:31 +0000 [warn]: '@' is the system reserved prefix. It works in the nested configuration for now but it will be rejected: @timestamp
/usr/local/share/gems/gems/fluent-plugin-elasticsearch-5.2.1/lib/fluent/plugin/elasticsearch_compat.rb:8: warning: already initialized constant TRANSPORT_CLASS
/usr/local/share/gems/gems/fluent-plugin-elasticsearch-5.2.1/lib/fluent/plugin/elasticsearch_compat.rb:3: warning: previous definition of TRANSPORT_CLASS was here
/usr/local/share/gems/gems/fluent-plugin-elasticsearch-5.2.1/lib/fluent/plugin/elasticsearch_compat.rb:25: warning: already initialized constant SELECTOR_CLASS
/usr/local/share/gems/gems/fluent-plugin-elasticsearch-5.2.1/lib/fluent/plugin/elasticsearch_compat.rb:20: warning: previous definition of SELECTOR_CLASS was here
2022-06-03 08:00:32 +0000 [warn]: parameter 'enable_flatten_labels' in <filter **>
  @type viaq_data_model
  enable_flatten_labels true
  elasticsearch_index_prefix_field "viaq_index_name"
  default_keep_fields CEE,time,@timestamp,aushape,ci_job,collectd,docker,fedora-ci,file,foreman,geoip,hostname,ipaddr4,ipaddr6,kubernetes,level,message,namespace_name,namespace_uuid,offset,openstack,ovirt,pid,pipeline_metadata,rsyslog,service,systemd,tags,testcase,tlog,viaq_msg_id
  extra_keep_fields 
  keep_empty_fields message
  use_undefined false
  undefined_name "undefined"
  rename_time true
  rename_time_if_missing false
  src_time_name "time"
  dest_time_name "@timestamp"
  pipeline_type collector
  undefined_to_string false
  undefined_dot_replace_char "UNUSED"
  undefined_max_num_fields -1
  process_kubernetes_events false
  <level>
    name "warn"
    match "Warning|WARN|^W[0-9]+|level=warn|Value:warn|\"level\":\"warn\""
  </level>
  <level>
    name "info"
    match "Info|INFO|^I[0-9]+|level=info|Value:info|\"level\":\"info\""
  </level>
  <level>
    name "error"
    match "Error|ERROR|^E[0-9]+|level=error|Value:error|\"level\":\"error\""
  </level>
  <level>
    name "critical"
    match "Critical|CRITICAL|^C[0-9]+|level=critical|Value:critical|\"level\":\"critical\""
  </level>
  <level>
    name "debug"
    match "Debug|DEBUG|^D[0-9]+|level=debug|Value:debug|\"level\":\"debug\""
  </level>
  <formatter>
    tag "system.var.log**"
    type sys_var_log
    remove_keys "host,pid,ident"
  </formatter>
  <formatter>
    tag "journal.system**"
    type sys_journal
    remove_keys "log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID"
  </formatter>
  <formatter>
    tag "kubernetes.journal.container**"
    type k8s_journal
    remove_keys "log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID"
  </formatter>
  <formatter>
    tag "kubernetes.var.log.pods.**_eventrouter-** k8s-audit.log** openshift-audit.log** ovn-audit.log**"
    type k8s_json_file
    remove_keys "log,stream,CONTAINER_ID_FULL,CONTAINER_NAME"
    process_kubernetes_events true
  </formatter>
  <formatter>
    tag "kubernetes.var.log.pods**"
    type k8s_json_file
    remove_keys "log,stream,CONTAINER_ID_FULL,CONTAINER_NAME"
  </formatter>
</filter> is not used.
2022-06-03 08:00:32 +0000 [warn]: parameter 'enable_prune_labels' in <filter **>
  @type viaq_data_model
  enable_prune_labels true
  prune_labels_exclusions app_kubernetes_io/name,app_kubernetes_io/instance,app_kubernetes_io/version,app_kubernetes_io/component,app_kubernetes_io/part-of,app_kubernetes_io/managed-by,app_kubernetes_io/created-by
</filter> is not used.
2022-06-03 08:00:32 +0000 [warn]: parameter 'prune_labels_exclusions' in <filter **>
  @type viaq_data_model
  enable_prune_labels true
  prune_labels_exclusions app_kubernetes_io/name,app_kubernetes_io/instance,app_kubernetes_io/version,app_kubernetes_io/component,app_kubernetes_io/part-of,app_kubernetes_io/managed-by,app_kubernetes_io/created-by
</filter> is not used.
2022-06-03 08:00:32 +0000 [warn]: For security reason, setting private_key_passphrase is recommended when cert_path is specified

spec:
  collection:
    logs:
      fluentd: {}
      type: fluentd
  logStore:
    elasticsearch:
      nodeCount: 1
      redundancyPolicy: ZeroRedundancy
      resources:
        limits:
          memory: 2Gi
        requests:
          cpu: 200m
          memory: 2Gi
      storage: {}
    type: elasticsearch
  managementState: Unmanaged
  visualization:
    kibana:
      replicas: 1
    type: kibana