Summary

Investigate and design alternative(s) for event collection, normalization, and storage from the existing workflow based upon the eventrouter.

Acceptance Criteria

• Summarize findings in a comment (or linked document if needed).
• Link any relevant resources or documents.
• Create follow-up JIRAs for further progress on the issue.
• Get findings reviewed by a team lead or architect.
• Create enhancement document in the openshift/enhancement repo

Requirements:

• Event collection and forwarding is a first class concept for Cluster Logging and specifically the ClusterLogForwarder API
• Events are namespaced resources and should be aggregated accordingly
• Events should be normalized with namespace_labels (OBSDA-538) so they maybe associated with logs from container workloads
• Event collection is 'opt-in' for administrators
• Event collection should allow spec of resource and scheduling if deployment separate from the log collector is required

Notes & Questions

• Consider we may only wish to enable the new design for OTEL only
• Architecture Discussion
• What is the impact and/or changes needed to LokiStack log-storage?
• What security needs to be added (additional roles?)?
• Can (should) we enable the eventrouter to write directly to the collector?
• How many event collectors do we need? How is it deployed?
• Is this the responsibility of the log collector? Do we want to add it there are enhance, modify the eventrouter?