-
Bug
-
Resolution: Done-Errata
-
Major
-
Logging 5.7.4
-
None
-
False
-
None
-
False
-
NEW
-
NEW
-
Before this update, new empty indices were created after enabling parsing JSON logs even when the rollover conditions were not satisfied. With this update, rollover is skipped as long as the write-index is empty, thus avoiding creating empty indices.
-
Bug Fix
-
-
-
-
Log Storage - Sprint 241, Log Storage - Sprint 242, Log Storage - Sprint 243, Log Storage - Sprint 244, Log Storage - Sprint 245
-
Moderate
-
Medium (50%-79%) [It is possible this will become an issue]
Description of problem:
Similar to LOG-3063. in the past.
-OCP version 4.12
-RHOL VERSION 5.7.4
After enabling parsing JSON logs functionality in ClusterLogForwarder (CLF) instance, new empty indices (app, infra, and audit) are created without fulfilling the following characteristics:
-The index is older than the rollover.maxAge value in the Elasticsearch CR.
-The index size is greater than 40 GB × the number of primary shards.
-The index doc count is greater than 40960 KB × the number of primary shards.
These new indices created are empty but they are created without complying with the characteristics that the cronjobs have to do the rollover. After a time we found a lot of empty indexes.
This could give performance problems since the indices use metadata.
- links to
-
RHBA-2023:123712 Logging Subsystem 5.8.1 - Red Hat OpenShift
- mentioned on