Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-2801

After upgrade all logs are stored in app indices

XMLWordPrintable

    • False
    • None
    • False
    • NEW
    • VERIFIED
    • Hide
      Before this update, the addition of multi-line error detection caused internal routing to change and forward records to the wrong destination. With this update, the internal routing is correct.
      Show
      Before this update, the addition of multi-line error detection caused internal routing to change and forward records to the wrong destination. With this update, the internal routing is correct.
    • Hide

      1. Install EO and CLO in stable-5.4 (not reproducible in stable-5.3 in this moment).

      $ oc get csv
      NAME                           DISPLAY                            VERSION   REPLACES   PHASE
      cluster-logging.5.4.2          Red Hat OpenShift Logging          5.4.2                Succeeded
      elasticsearch-operator.5.4.2   OpenShift Elasticsearch Operator   5.4.2                Succeeded
      

       

      2. Configure clusterLogForwader adding "detectMultilineErrors: true", the complete CLF configuration is:

      apiVersion: v1
      items:
      - apiVersion: logging.openshift.io/v1
        kind: ClusterLogForwarder
        metadata:
          name: instance
          namespace: openshift-logging
        spec:
          pipelines:
          - detectMultilineErrors: true
            inputRefs:
            - application
            - infrastructure
            outputRefs:
            - default

      3. Check from Kibana the logs for app using for example the filter `kubernetes.namespace_name: openshift-*` and it will be visible the infra logs in the app- indices

       

      Show
      1. Install EO and CLO in stable-5.4 (not reproducible in stable-5.3 in this moment). $ oc get csv NAME DISPLAY VERSION REPLACES PHASE cluster-logging.5.4.2 Red Hat OpenShift Logging 5.4.2 Succeeded elasticsearch- operator .5.4.2 OpenShift Elasticsearch Operator 5.4.2 Succeeded   2. Configure clusterLogForwader adding "detectMultilineErrors: true", the complete CLF configuration is: apiVersion: v1 items: - apiVersion: logging.openshift.io/v1   kind: ClusterLogForwarder   metadata:     name: instance     namespace: openshift-logging   spec:     pipelines:     - detectMultilineErrors: true       inputRefs:       - application       - infrastructure       outputRefs:       - default 3. Check from Kibana the logs for app using for example the filter `kubernetes.namespace_name: openshift-*` and it will be visible the infra logs in the app- indices  

      .After upgrading to OpenShift Logging v5.4.2 logs from namespaces like openshift-* or audit logs are stored in app indices. This is happening only in one cluster. We do not see this issue in other clusters after this upgrade.

      • Enabled LogForwardin
      • OCP v4.9.29

            vparfono Vitalii Parfonov
            rhn-support-rludva Radomir Ludva
            Kabir Bharti Kabir Bharti
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: