apiVersion: "observability.openshift.io/v1"
  kind: ClusterLogForwarder
  metadata:
    name: clf-eck-es
  spec:
    managementState: Managed
    outputs:
    - name: eck-es
      type: elasticsearch
      elasticsearch:
        authentication:
          password:
            key: password
            secretName: es-https
          username:
            key: username
            secretName: es-https
        headers:
          test: logging
          Accept: application/json
          accept: application/json
        index: "{.log_type||\"none\"}"
        url: https://elasticsearch-sample-es-http.elasticsearch-operator.svc:9200
        version: 8
      tls:
        ca:
          key: ca-bundle.crt
          secretName: es-https
    pipelines:
    - name: forward-to-external-es
      inputRefs:
      - infrastructure
      - audit
      outputRefs:
      - eck-es
    serviceAccount:
      name: logcollector 

2026-01-20T02:32:07.774923Z ERROR vector::topology::builder: msg="Healthcheck failed." error=Unexpected status: 400 Bad Request component_kind="sink" component_type="elasticsearch" component_id=output_eck_es
2026-01-20T02:32:08.054456Z ERROR sink{component_kind="sink" component_id=output_eck_es component_type=elasticsearch}: vector::sinks::elasticsearch::service: Response contained errors. error_code="http_response_400" response=Response { status: 400, version: HTTP/1.1, headers: {"x-elastic-product": "Elasticsearch", "content-type": "application/json", "content-length": "349"}, body: b"{\"error\":{\"root_cause\":[{\"type\":\"media_type_header_exception\",\"reason\":\"Invalid media-type value on headers [Accept]\"}],\"type\":\"media_type_header_exception\",\"reason\":\"Invalid media-type value on headers [Accept]\",\"caused_by\":{\"type\":\"illegal_argument_exception\",\"reason\":\"Incorrect header [Accept]. Only one value should be provided\"}},\"status\":400}" }
2026-01-20T02:32:08.054588Z ERROR sink{component_kind="sink" component_id=output_eck_es component_type=elasticsearch}: vector::sinks::util::retries: Not retriable; dropping the request. reason="client-side error, 400 Bad Request: {\"error\":{\"root_cause\":[{\"type\":\"media_type_header_exception\",\"reason\":\"Invalid media-type value on headers [Accept]\"}],\"type\":\"media_type_header_exception\",\"reason\":\"Invalid media-type value on headers [Accept]\",\"caused_by\":{\"type\":\"illegal_argument_exception\",\"reason\":\"Incorrect header [Accept]. Only one value should be provided\"}},\"status\":400}" internal_log_rate_limit=true 

[sinks.output_eck_es.request]
headers = {"Accept"="application/json","accept"="application/json","test"="logging"}