clf-to-azure doc points to soon deprecated Openshift Elasticsearch operator?

[rh-mobb]

clf-to-azure doc points to soon deprecated Openshift Elasticsearch operator?

[andyrepton]

Hi there! This is more a question for the official docs, but I can help you out here if you like. Yes, what you're looking for is possible. Something like the following would be needed:

1. Install Cluster Logging Operator
2. Create a LogStorage like so, only specifying the collector field (so not specifying visualization or logStore):

apiVersion: logging.openshift.io/v1
kind: ClusterLogging
metadata:
  name:  <name> 
  namespace: <namespace> 
spec:
  managementState: "Managed"
  collection:
    type: "vector"

This will install the vector daemon-set (you should see the pods start to pop up in the openshift-logging namespace)

3. Create a ClusterLogForwarder CR like so, specifying where you'd like vector to send the logs:

apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: <log_forwarder_name> 
  namespace: <log_forwarder_namespace> 
spec:
  serviceAccountName: <service_account_name> 
  pipelines:
   - inputRefs:
     - <log_type> 
     outputRefs:
     - <output_name> 
  outputs:
  - name: <output_name> 
    type: <output_type> 
    url: <log_output_url> 

This should trigger vector to immediately reconfigure and start sending logs to your endpoint (you should see the pods restart with the correct config. If they do not, please check that the endpoint is in the supported list here: https://github.com/openshift/cluster-logging-operator/blob/master/api/logging/v1/output_types.go#L8

Hope this helps, and I'm working on some new how-to's for this site in my spare time. I'll leave this issue open so I can remember to crack on with it.

[justsomecorporateuser]

Thank you Andy! We will try that!

Best regards, Jan