Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-4220

[RHOCP4.11] Logs of POD which doesn't have labels specified by structuredTypeKey are parsed to JSON, and forwarded to app-xxxxxx

XMLWordPrintable

    • False
    • None
    • False
    • NEW
    • VERIFIED
    • Hide
      Prior to this fix, when a structuredTypeKey was not found, and a structuredTypeName was not specified, the log message was still parsed into structured object, but the index is not created AND the original message is not deleted. This fixes the issue so that the messages are not parsed in that scenario, as designed.
      Show
      Prior to this fix, when a structuredTypeKey was not found, and a structuredTypeName was not specified, the log message was still parsed into structured object, but the index is not created AND the original message is not deleted. This fixes the issue so that the messages are not parsed in that scenario, as designed.
    • Bug Fix
    • Proposed
    • Moderate

      Description of problem:

      Logs of POD which doesn't have labels specified by structuredTypeKey are parsed to JSON, and forwarded to app-xxxxxx.
      This will cause type conflicts and cardinality problem described at docs [1].

      [1] https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html-single/logging/index#cluster-logging-configuration-of-json-log-data-for-default-elasticsearch_cluster-logging-enabling-json-logging

      Version-Release number of selected component (if applicable):

      OpenShift v4.11.5 with OpenShift Logging 5.5.3.

      How reproducible:

      Always

      Steps to Reproduce:

      Step1. Deploy app which emits JSON log messages.Step2. Create the following CLF CR and aplly it.

      apiVersion: "logging.openshift.io/v1"
      kind: ClusterLogForwarder
      metadata:
        name: instance
        namespace: openshift-logging
      spec:
        inputs:
        - name: structuredTypeKey-k8slabels
          application:
            namespaces:
              - my-app
        outputDefaults:
          elasticsearch:
            structuredTypeKey: kubernetes.labels.k8slabels
        pipelines:
        - name: structuredTypeKey-k8slabels
          inputRefs:
          - structuredTypeKey-k8slabels
          outputRefs:
          - default
          parse: json
      

      Step3. Check forwarded logs.

      Actual results:

      Logs from app are parsed to JSON, and forwarded to app-xxxxxx.

      Expected results:

      Logs from app are not parsed to JSON.

              cahartma@redhat.com Casey Hartman
              rhn-support-kbharti Kabir Bharti
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: