Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-2946

After upgrade all logs are stored in app indices

XMLWordPrintable

    • False
    • None
    • False
    • NEW
    • VERIFIED
    • Hide
      Before this update, the addition of multi-line error detection caused internal routing to change and forward records to the wrong destination. With this update, the internal routing is correct.
      Show
      Before this update, the addition of multi-line error detection caused internal routing to change and forward records to the wrong destination. With this update, the internal routing is correct.
    • Hide

      1. Install EO and CLO in stable-5.4 (not reproducible in stable-5.3 in this moment).

      $ oc get csv
NAME                           DISPLAY                            VERSION   REPLACES   PHASE
cluster-logging.5.4.2          Red Hat OpenShift Logging          5.4.2                Succeeded
elasticsearch-operator.5.4.2   OpenShift Elasticsearch Operator   5.4.2                Succeeded

       

      2. Configure clusterLogForwader adding "detectMultilineErrors: true", the complete CLF configuration is:

      apiVersion: v1
items:
- apiVersion: logging.openshift.io/v1
  kind: ClusterLogForwarder
  metadata:
    name: instance
    namespace: openshift-logging
  spec:
    pipelines:
    - detectMultilineErrors: true
      inputRefs:
      - application
      - infrastructure
      outputRefs:
      - default

      3. Check from Kibana the logs for app using for example the filter `kubernetes.namespace_name: openshift-*` and it will be visible the infra logs in the app- indices

       

      Show
      1. Install EO and CLO in stable-5.4 (not reproducible in stable-5.3 in this moment). $ oc get csv NAME DISPLAY VERSION REPLACES PHASE cluster-logging.5.4.2 Red Hat OpenShift Logging 5.4.2 Succeeded elasticsearch- operator .5.4.2 OpenShift Elasticsearch Operator 5.4.2 Succeeded   2. Configure clusterLogForwader adding "detectMultilineErrors: true", the complete CLF configuration is: apiVersion: v1 items: - apiVersion: logging.openshift.io/v1   kind: ClusterLogForwarder   metadata:     name: instance     namespace: openshift-logging   spec:     pipelines:     - detectMultilineErrors: true       inputRefs:       - application       - infrastructure       outputRefs:       - default 3. Check from Kibana the logs for app using for example the filter `kubernetes.namespace_name: openshift-*` and it will be visible the infra logs in the app- indices  

      .After upgrading to OpenShift Logging v5.4.2 logs from namespaces like openshift-* or audit logs are stored in app indices. This is happening only in one cluster. We do not see this issue in other clusters after this upgrade.

      • Enabled LogForwardin
      • OCP v4.9.29

              vparfono Vitalii Parfonov
              rhn-support-rludva Radomir Ludva
              Qiaoling Tang Qiaoling Tang
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: