Loading...

XML

Word

Printable

Details

Type: Bug
Resolution: Done
Priority: Major
Fix Version/s: Logging 5.5.1
Affects Version/s: Logging 5.4.2
Component/s: Log Collection
Labels:

Blocked:
False
Blocked Reason:
None
Ready:
False
Docs QE Status:
NEW
QE Status:
VERIFIED
Release Note Text:

Hide
Before this update, the addition of multi-line error detection caused internal routing to change and forward records to the wrong destination. With this update, the internal routing is correct.

Show
Before this update, the addition of multi-line error detection caused internal routing to change and forward records to the wrong destination. With this update, the internal routing is correct.
Steps to Reproduce:
Hide

1. Install EO and CLO in stable-5.4 (not reproducible in stable-5.3 in this moment).

$ oc get csv NAME DISPLAY VERSION REPLACES PHASE cluster-logging.5.4.2 Red Hat OpenShift Logging 5.4.2 Succeeded elasticsearch-operator.5.4.2 OpenShift Elasticsearch Operator 5.4.2 Succeeded

2. Configure clusterLogForwader adding "detectMultilineErrors: true", the complete CLF configuration is:

apiVersion: v1 items: - apiVersion: logging.openshift.io/v1 kind: ClusterLogForwarder metadata: name: instance namespace: openshift-logging spec: pipelines: - detectMultilineErrors: true inputRefs: - application - infrastructure outputRefs: - default

3. Check from Kibana the logs for app using for example the filter `kubernetes.namespace_name: openshift-*` and it will be visible the infra logs in the app- indices
Show
1. Install EO and CLO in stable-5.4 (not reproducible in stable-5.3 in this moment). $ oc get csv NAME DISPLAY VERSION REPLACES PHASE cluster-logging.5.4.2 Red Hat OpenShift Logging 5.4.2 Succeeded elasticsearch- operator .5.4.2 OpenShift Elasticsearch Operator 5.4.2 Succeeded 2. Configure clusterLogForwader adding "detectMultilineErrors: true", the complete CLF configuration is: apiVersion: v1 items: - apiVersion: logging.openshift.io/v1 kind: ClusterLogForwarder metadata: name: instance namespace: openshift-logging spec: pipelines: - detectMultilineErrors: true inputRefs: - application - infrastructure outputRefs: - default 3. Check from Kibana the logs for app using for example the filter `kubernetes.namespace_name: openshift-*` and it will be visible the infra logs in the app- indices

SFDC Cases Links:
SFDC Cases Counter:

Description

.After upgrading to OpenShift Logging v5.4.2 logs from namespaces like openshift-* or audit logs are stored in app indices. This is happening only in one cluster. We do not see this issue in other clusters after this upgrade.