Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-8597

Prune not working for audit logs

XMLWordPrintable

    • Incidents & Support
    • False
    • Hide

      None

      Show
      None
    • False
    • NEW
    • NEW
    • Hide
      Before this update, the prune filter did not function correctly for audit logs, resulting in unexpected field removal or retention. With this update, the prune filter behavior for audit logs has been corrected, ensuring fields are pruned according to the configured rules.
      Show
      Before this update, the prune filter did not function correctly for audit logs, resulting in unexpected field removal or retention. With this update, the prune filter behavior for audit logs has been corrected, ensuring fields are pruned according to the configured rules.
    • Bug Fix
    • Logging - Sprint 283, Logging - Sprint 284
    • Important

      Description of problem:

      When it's pruned fields from audit logs with a configuration like:

      apiVersion: observability.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: collector
  namespace: openshift-logging 
spec:
  serviceAccount:
    name: collector
  filters:
  - name: remove-unwanted-fields
    type: prune
    prune:
      in:
      - .requestReceivedTimestamp
      - .apiVersion
      - .requestURI
      - .userAgent
      - .stage
      - .stageTimestamp
  outputs:
  - name: ocp-lokistack
    type: lokiStack 
    lokiStack:
      target: 
        name: logging-loki
        namespace: openshift-logging
      authentication:
        token:
          from: serviceAccount
    tls:
      ca:
        key: service-ca.crt
        configMapName: openshift-service-ca.crt
  pipelines:
  - name: audit-logs
    inputRefs:  
    - audit 
    filterRefs: ["remove-unwanted-fields"]
    outputRefs:
    - ocp-lokistack

      Version-Release number of selected component (if applicable):

      Logging 6.4.1
      Loki 6.4.1

      How reproducible:

      Always

      Steps to Reproduce:

      1. Create a ClusterLogForwarder as the shared in the section of this ticket "Description of problem"

      Actual results:

      Wait some minutes and review going to the "OpenShift console > Observe > Logs" and querying for the audit logs that the fields expected to be pruned are present

      Expected results:

      Fields are pruned

      Additional info:

      Workaround

      Replace from the filter:

            - .requestReceivedTimestamp
      - .apiVersion
      - .requestURI
      - .userAgent
      - .stage
      - .stageTimestamp

      to be

            - .structured.requestReceivedTimestamp
      - .structured.apiVersion
      - .structured.requestURI
      - .structured.userAgent
      - .structured.stage
      - .structured.stageTimestamp

        1. Screenshot 2026-03-02 at 15.20.39.png
          Screenshot 2026-03-02 at 15.20.39.png
          204 kB

              vparfono Vitalii Parfonov
              rhn-support-ocasalsa Oscar Casal Sanchez
              Qiaoling Tang Qiaoling Tang
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: