Skip to content

Commit 387ddcd

Browse files
mburke5678mburke5678
authored
Merge pull request #25793 from mburke5678/logging-access-logs
Adding topic for logs in Kibana
2 parents 00600ce + 788cd0e commit 387ddcd

8 files changed

+135
-22
lines changed

‎_topic_map.yml‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1406,13 +1406,10 @@ Topics:
14061406
- Name: Maintenance and support
14071407
File: cluster-logging-maintenance-support
14081408
- Name: Viewing cluster logs
1409-
Dir: viewing
1409+
File: cluster-logging-viewing
1410+
- Name: Viewing cluster logs in Kibana
1411+
File: cluster-logging-visualizer
14101412
Distros: openshift-enterprise,openshift-webscale,openshift-origin
1411-
Topics:
1412-
- Name: Viewing cluster logs in the console or CLI
1413-
File: cluster-logging-viewing
1414-
- Name: Viewing cluster logs using Kibana
1415-
File: cluster-logging-visualizer
14161413
# TODO: This file doesn't exist anymore - update if necessary for dedicated
14171414
# - Name: Viewing cluster logs using Kibana
14181415
# File: cluster-logging-kibana-interface

logging/viewing/cluster-logging-viewing.adoc renamed to logging/cluster-logging-viewing.adoc

File renamed without changes.

logging/viewing/cluster-logging-visualizer.adoc renamed to logging/cluster-logging-visualizer.adoc

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,32 @@
11
:context: cluster-logging-visualizer
22
[id="cluster-logging-visualizer-using"]
3-
= Viewing cluster logs using Kibana
3+
= Viewing cluster logs by using Kibana
44
include::modules/common-attributes.adoc[]
55

66
toc::[]
77

88
{product-title} cluster logging includes a web console for visualizing collected log data. Currently, {product-title} deploys the Kibana console for visualization.
99

10-
Using the log visualizer, you can:
10+
Using the log visualizer, you can do the following with your data:
1111

12-
* Search and browse your data using the *Discover* tab.
13-
* Chart and map your data using the *Visualize* tab.
14-
* Create and view custom dashboards using the *Dashboard* tab.
12+
* search and browse the data using the *Discover* tab.
13+
* chart and map the data using the *Visualize* tab.
14+
* create and view custom dashboards using the *Dashboard* tab.
1515
1616
Use and configuration of the Kibana interface is beyond the scope of this documentation. For more information,
1717
on using the interface, see the link:https://www.elastic.co/guide/en/kibana/6.8/connect-to-elasticsearch.html[Kibana documentation].
1818

1919
[NOTE]
2020
====
21-
The audit logs are not stored in the internal {product-title} Elasticsearch instance by default. To view the audit logs in Kibana, you must use the xref:../../logging/config/cluster-logging-log-store.adoc#cluster-logging-elasticsearch-audit_cluster-logging-store[Log Forwarding API] to configure a pipeline that uses the `default` output for audit logs.
21+
The audit logs are not stored in the internal {product-title} Elasticsearch instance by default. To view the audit logs in Kibana, you must use the xref:../logging/config/cluster-logging-log-store.adoc#cluster-logging-elasticsearch-audit_cluster-logging-store[Log Forwarding API] to configure a pipeline that uses the `default` output for audit logs.
2222
====
2323

2424
// The following include statements pull in the module files that comprise
2525
// the assembly. Include any combination of concept, procedure, or reference
2626
// modules required to cover the user story. You can also include other
2727
// assemblies.
2828

29-
include::modules/cluster-logging-visualizer-launch.adoc[leveloffset=+1]
3029
include::modules/cluster-logging-visualizer-indices.adoc[leveloffset=+1]
31-
// modules/cluster-logging-kibana-visualize.adoc[leveloffset=+1]
32-
30+
include::modules/cluster-logging-visualizer-kibana.adoc[leveloffset=+1]
3331

3432

‎logging/cluster-logging.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ toc::[]
1010
ifdef::openshift-enterprise,openshift-webscale,openshift-origin[]
1111
As a cluster administrator, you can deploy cluster logging to
1212
aggregate all the logs from your {product-title} cluster, such as node system audit logs, application container logs, and infrastructure logs.
13-
Cluster logging aggregates these logs from throughout your cluster and stores them in a default log store. You can xref:../logging/viewing/cluster-logging-viewing.adoc#cluster-logging-viewing[view the logs in a console or the {product-title} web console] or xref:../logging/viewing/cluster-logging-visualizer.adoc#cluster-logging-visualizer[use Kibana to visualize log data].
13+
Cluster logging aggregates these logs from throughout your cluster and stores them in a default log store. You can xref:../logging/cluster-logging-visualizer.adoc#cluster-logging-visualizer[use the Kibana web console to visualize log data].
1414

1515
Cluster logging aggregates the following types of logs:
1616

‎logging/viewing/images‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎modules/cluster-logging-visualizer-indices.adoc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@ An index pattern defines the Elasticsearch indices that you want to visualize. T
99

1010
.Prerequisites
1111

12-
* A user must have the `cluster-admin` role, the `cluster-reader` role, or both roles to list the *infra* and *audit* indices in Kibana.
12+
* A user must have the `cluster-admin` role, the `cluster-reader` role, or both roles to view the *infra* and *audit* indices in Kibana. The default `kubeadmin` user has proper permissions to view these indices.
1313
+
14-
For example:
14+
If you can view the pods and logs in the `default`, `kube-` and `openshift-` projects, you should be able to access the these indices. You can use the following command to check if the current user has appropriate permissions:
1515
+
1616
[source,terminal]
1717
----
18-
$ oc auth can-i get pods/logs -n default
18+
$ oc auth can-i get pods/log -n <project>
1919
----
2020
+
2121
.Example output

‎modules/cluster-logging-visualizer-kibana.adoc‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * logging/viewing/cluster-logging-visualizer.adoc
4+
5+
[id="cluster-logging-visualizer-kibana_{context}"]
6+
= Viewing cluster logs in Kibana
7+
8+
You view cluster logs in the Kibana web console. The methods for viewing and visualizing your data in Kibana that are beyond the scope of this documentation. For more information, refer to the link:https://www.elastic.co/guide/en/kibana/6.8/tutorial-sample-discover.html[Kibana documentation].
9+
10+
.Prerequisites
11+
12+
* Cluster logging and Elasticsearch must be installed.
13+
14+
* Kibana index patterns must exist.
15+
16+
* A user must have the `cluster-admin` role, the `cluster-reader` role, or both roles to view the *infra* and *audit* indices in Kibana. The default `kubeadmin` user has proper permissions to view these indices.
17+
+
18+
If you can view the pods and logs in the `default`, `kube-` and `openshift-` projects, you should be able to access the these indices. You can use the following command to check if the current user has appropriate permissions:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc auth can-i get pods/log -n <project>
23+
----
24+
+
25+
.Example output
26+
[source,terminal]
27+
----
28+
yes
29+
----
30+
+
31+
[NOTE]
32+
====
33+
The audit logs are not stored in the internal {product-title} Elasticsearch instance by default. To view the audit logs in Kibana, you must use the Log Forwarding API to configure a pipeline that uses the `default` output for audit logs.
34+
====
35+
36+
.Procedure
37+
38+
To view logs in Kibana:
39+
40+
. In the {product-title} console, click the Application Launcher {launch} and select *Logging*.
41+
42+
. Log in using the same credentials you use to log in to the {product-title} console.
43+
+
44+
The Kibana interface launches.
45+
46+
. In Kibana, click *Discover*.
47+
48+
. Select the index pattern you created from the drop-down menu in the top-left corner: *app*, *audit*, or *infra*.
49+
+
50+
The log data displays as time-stamped documents.
51+
52+
. Expand one of the time-stamped documents.
53+
54+
. Click the *JSON* tab to display the log entry for that document.
55+
+
56+
.Sample infrastructure log entry in Kibana
57+
[source,terminal]
58+
----
59+
{
60+
"_index": "infra-000001",
61+
"_type": "_doc",
62+
"_id": "YmJmYTBlNDkZTRmLTliMGQtMjE3NmFiOGUyOWM3",
63+
"_version": 1,
64+
"_score": null,
65+
"_source": {
66+
"docker": {
67+
"container_id": "f85fa55bbef7bb783f041066be1e7c267a6b88c4603dfce213e32c1"
68+
},
69+
"kubernetes": {
70+
"container_name": "registry-server",
71+
"namespace_name": "openshift-marketplace",
72+
"pod_name": "redhat-marketplace-n64gc",
73+
"container_image": "registry.redhat.io/redhat/redhat-marketplace-index:v4.6",
74+
"container_image_id": "registry.redhat.io/redhat/redhat-marketplace-index@sha256:65fc0c45aabb95809e376feb065771ecda9e5e59cc8b3024c4545c168f",
75+
"pod_id": "8f594ea2-c866-4b5c-a1c8-a50756704b2a",
76+
"host": "ip-10-0-182-28.us-east-2.compute.internal",
77+
"master_url": "https://kubernetes.default.svc",
78+
"namespace_id": "3abab127-7669-4eb3-b9ef-44c04ad68d38",
79+
"namespace_labels": {
80+
"openshift_io/cluster-monitoring": "true"
81+
},
82+
"flat_labels": [
83+
"catalogsource_operators_coreos_com/update=redhat-marketplace"
84+
]
85+
},
86+
"message": "time=\"2020-09-23T20:47:03Z\" level=info msg=\"serving registry\" database=/database/index.db port=50051",
87+
"level": "unknown",
88+
"hostname": "ip-10-0-182-28.internal",
89+
"pipeline_metadata": {
90+
"collector": {
91+
"ipaddr4": "10.0.182.28",
92+
"inputname": "fluent-plugin-systemd",
93+
"name": "fluentd",
94+
"received_at": "2020-09-23T20:47:15.007583+00:00",
95+
"version": "1.7.4 1.6.0"
96+
}
97+
},
98+
"@timestamp": "2020-09-23T20:47:03.422465+00:00",
99+
"viaq_msg_id": "YmJmYTBlNDktMDMGQtMjE3NmFiOGUyOWM3",
100+
"openshift": {
101+
"labels": {
102+
"logging": "infra"
103+
}
104+
}
105+
},
106+
"fields": {
107+
"@timestamp": [
108+
"2020-09-23T20:47:03.422Z"
109+
],
110+
"pipeline_metadata.collector.received_at": [
111+
"2020-09-23T20:47:15.007Z"
112+
]
113+
},
114+
"sort": [
115+
1600894023422
116+
]
117+
}
118+
----
119+

‎modules/cluster-logging-visualizer-launch.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@ pie charts, heat maps, built-in geospatial support, and other visualizations.
1212

1313
* To list the *infra* and *audit* indices in Kibana, a user must have the `cluster-admin` role, the `cluster-reader` role, or both roles. The default `kubeadmin` user has proper permissions to list these indices.
1414
+
15-
If you can view the pods and logs in the `default` project, you should be able to access the these indices. You can use the following command to check if the current user has proper permissions:
15+
If you can view the pods and logs in the `default`, `kube-*` and `openshift-*` projects, you should be able to access the these indices. You can use the following command to check if the current user has proper permissions:
1616
+
1717
[source,terminal]
1818
----
19-
$ oc auth can-i get pods/logs -n default
19+
$ oc auth can-i get pods/log -n <project>
2020
----
2121
+
2222
.Example output

0 commit comments

Comments
 (0)