CLF - syslog
oc create sa rsyslogserver
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-logging:rsyslogserver
oc create secret generic rsyslogserver --from-file=tls.key=generated-ca/logging-es.key --from-file=tls.crt=generated-ca/logging-es.crt --from-file=ca-bundle.crt=generated-ca/ca.crt --from-file=ca.key=generated-ca/ca.key --from-literal=shared_key=rsyslogserver
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: rsyslogserver
  labels:
    provider: aosqe
    component: "rsyslogserver"
data:
  rsyslog.conf: |+
    global(processInternalMessages="on")
    module(load="imptcp")
    module(load="imudp" TimeRequery="500")

    input(type="imptcp" port="514")
    input(type="imudp" port="514")

    :programname, contains, "kubernetes.var.log.containers" {
      if $msg contains "namespace_name=openshift" or $msg contains "namespace_name=default" or $msg contains "namespace_name=kube" then /var/log/custom/infra-container.log
      if not ($msg contains "namespace_name=openshift" or $msg contains "namespace_name=default" or $msg contains "namespace_name=kube") then /var/log/custom/app-container.log
    }
    :programname, !contains, "kubernetes.var.log.containers" /var/log/custom/infra.log

    :msg, contains, "docker"{
      if $msg contains "viaq_index_name:infra-write" then /var/log/custom/infra-container.log
      if $msg contains "viaq_index_name:app-write" then /var/log/custom/app-container.log
    }
    :msg, contains, "_STREAM_ID" /var/log/custom/infra.log
    :msg, contains, "auditID" /var/log/custom/audit.log
EOF
oc create -f https://raw.githubusercontent.com/openshift/verification-tests/master/testdata/logging/logforwarding/rsyslog/insecure/rsyslogserver_deployment.yaml 
oc create -f https://raw.githubusercontent.com/openshift/verification-tests/master/testdata/logging/logforwarding/rsyslog/rsyslogserver_svc.yaml 
cat <<EOF | oc create -f -
apiVersion: logging.openshift.io/v1      
kind: ClusterLogForwarder      
metadata:      
  name: instance      
  namespace: openshift-logging      
spec:      
  outputs:      
    - name: rsyslog-created-by-user
      secret:
        name: rsyslogserver  
      type: syslog      
      syslog:      
        facility: local0     
        severity: informational
      url: 'udp://rsyslogserver.openshift-logging.svc:514'      
  pipelines:      
    - name: forward-to-external-syslog      
      inputRefs:      
        - infrastructure      
        - application      
        - audit      
      outputRefs:      
        - rsyslog-created-by-user
EOF

oc delete pod --selector logging-infra=fluentd
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CLF - elasticsearch-server
oc create sa elasticsearch-server
oc adm policy add-scc-to-user  privileged system:serviceaccount:openshift-logging:elasticsearch-server
oc create -f https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/logging/logforwarding/elasticsearch/insecure/configmap.yaml
oc create -f https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/logging/logforwarding/elasticsearch/insecure/deployment.yaml  
oc expose deployment/elasticsearch-server
cat <<EOF | oc create -f -
apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: instance
  namespace: openshift-logging
spec:
  outputs:
    - name: es-created-by-user
      type: elasticsearch
      url: 'http://elasticsearch-server.openshift-logging.svc:9200'
  pipelines:
    - name: forward-to-external-es
      inputRefs:
      - infrastructure
      - application
      - audit
      outputRefs:
      - es-created-by-user
      - default
EOF
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CLF - fluentd server

oc create secret generic fluentdserver --from-file=tls.key=generated-ca/logging-es.key --from-file=tls.crt=generated-ca/logging-es.crt --from-file=ca-bundle.crt=generated-ca/ca.crt --from-file=ca.key=generated-ca/ca.key --from-literal=shared_key=fluentdserver
oc create sa fluentdserver
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-logging:fluentdserver
oc create -f https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/logging/logforwarding/fluentd/secure/configmap.yaml 
oc create -f https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/logging/logforwarding/fluentd/secure/fluentdserver_deployment.yaml 
oc expose deployment/fluentdserver
cat <<EOF |oc create -f -
apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: instance
  namespace: openshift-logging
spec:
  outputs:
    - name: fluentd-created-by-user
      type: fluentdForward
      url: 'tls://fluentdserver.openshift-logging.svc:24224'
      secret:
         name: 'fluentdserver'
  pipelines:
    - name: forward-to-fluentd-server
      inputRefs:
      - infrastructure
      - application
      - audit
      outputRefs:
      - fluentd-created-by-user
EOF