You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The {product-title} cluster log forwarding feature uses a combination of _outputs_ and _pipelines_ defined in the Log Forwarding Custom Resource to send logs to specific endpoints inside and outside of your {product-title} cluster.
8
+
Forwarding cluster logs using the Log Forwarding API requires a combination of _outputs_ and _pipelines_ to send logs to specific endpoints inside and outside of your {product-title} cluster.
9
9
10
10
[NOTE]
11
11
====
@@ -19,7 +19,7 @@ An _output_ is the destination for log data and a _pipeline_ defines simple rout
19
19
An output can be either:
20
20
21
21
* `elasticsearch` to forward logs to an external Elasticsearch v5.x cluster and/or the internal {product-title} Elasticsearch instance.
22
-
* `forward` to forward logs to an external log aggregation solution. This option uses the Fluentd *forward* plug-ins.
22
+
* `forward` to forward logs to an external log aggregation solution. This option uses the Fluentd *forward* protocols.
23
23
24
24
[NOTE]
25
25
====
@@ -29,7 +29,7 @@ The endpoint must be a server name or FQDN, not an IP Address, if the cluster-wi
29
29
A _pipeline_ associates the source of the data to an output. The source of the data is one of the following:
30
30
31
31
* `logs.app` - Container logs generated by user applications running in the cluster, except infrastructure container applications.
32
-
* `logs.infra` - Logs generated by both infrastructure components running in the cluster and {product-title} nodes, such as journal logs. Infrastructure components are pods that run in the `openshift*`, `kube*`, or `default` projects.
32
+
* `logs.infra` - Logs generated by infrastructure components running in the cluster and {product-title} nodes, such as journal logs. Infrastructure components are pods that run in the `openshift*`, `kube*`, or `default` projects.
33
33
* `logs.audit` - Logs generated by the node audit system (auditd), which are stored in the */var/log/audit/audit.log* file, and the audit logs from the Kubernetes apiserver and the OpenShift apiserver.
34
34
35
35
Note the following:
@@ -44,13 +44,13 @@ The following example creates three outputs:
44
44
45
45
* the internal {product-title} Elasticsearch instance,
46
46
* an unsecured externally-managed Elasticsearch instance,
47
-
* a secured external log aggregator using the *forward* plug-in.
47
+
* a secured external log aggregator using the *forward* protocols.
48
48
49
49
Three pipelines send:
50
50
51
51
* the application logs to the internal {product-title} Elasticsearch,
52
52
* the infrastructure logs to an external Elasticsearch instance,
53
-
* the audit logs to the secured device over the *forward* plug-in.
53
+
* the audit logs to the secured device over the *forward* protocols.
54
54
55
55
.Sample log forwarding outputs and pipelines
56
56
[source,yaml]
@@ -97,7 +97,7 @@ spec:
97
97
<3> Configuration for the outputs.
98
98
<4> A name to describe the output.
99
99
<5> The type of output, either `elasticsearch` or `forward`.
100
-
* Enter the endpoint, either the server name, FQDN, or IP address. If the cluster-wide proxy using the CIDR annotation is enabled, the endpoint must be a server name or FQDN, not an IP Address. For the internal {product-title} Elasticsearch instance, specify `elasticsearch.openshift-logging.svc:9200`.
100
+
<6> Enter the endpoint, either the server name, FQDN, or IP address. If the cluster-wide proxy using the CIDR annotation is enabled, the endpoint must be a server name or FQDN, not an IP Address. For the internal {product-title} Elasticsearch instance, specify `elasticsearch.openshift-logging.svc:9200`.
101
101
<7> Optional name of the secret required by the endpoint for TLS communication. The secret must exist in the `openshift-logging` project.
102
102
<8> Optional setting if the endpoint does not use a secret, resulting in insecure communication.
0 commit comments