Goals

The cluster logging operator adds metadata fields to most application, infrastructure and audit logs.

However it does not add those fields to kubernetes event logs generated by the eventrouter.

Metadata should be added to eventrouter events in the same way it is for API audit events: directly in the root of the JSON payload, rather than as an envelope.

This resolves RFE-3526   by making the existing pipeline.labels configuation apply to event router logs. It also brings other useful features to eventrouter logs (cluster-id etc.).

Non-goals

Motivation

Same as for other logs - audit and event logs from multiple clusters need to be identified with the originating cluster-id and possibly with custom labels.

Alternatives

• Modify the eventrouter to add information at the source.
  • Duplicates code between eventrouter and logging operator
  • Does not allow CLF configuration (e.g. openshift.labels) to add metadata.
• Wrap events in a meta-data envelope, with  original event as the "structured" field.
  • Breaks existing JSON parsing code for these events.

Acceptance Criteria

Metadata labels are included in eventrouter event logs.

Risk and Assumptions

Documentation Considerations

None special, this is making eventrouter logs more consistent with other logs.

Open Questions

Additional Notes

Some metadata fields are not relevant for k8s event logs, we could identify a subset.

This question is being addressed by LOG-2827 - it should be addressed there across the board rather than separately for event logs.