$ oc edit clusterlogging instance
In OpenShift Container Platform 4.5, log curation is performed by Elasticsearch Curator, based on a retention policy that you define.
The Elasticsearch Curator tool removes Elasticsearch indices that use the data model prior to OpenShift Container Platform 4.5. You can modify the Curator index retention policy for your old data.
You can specify the schedule for Curator using the Cluster Logging
custom resource
created by the cluster logging installation.
Cluster logging and Elasticsearch must be installed.
To configure the Curator schedule:
Edit the ClusterLogging
custom resource in the openshift-logging
project:
$ oc edit clusterlogging instance
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
metadata:
name: "instance"
...
curation:
curator:
schedule: 30 3 * * * (1)
type: curator
1 | Specify the schedule for Curator in cron format. |
The time zone is set based on the host node where the Curator pod runs. |
You can configure Curator to delete Elasticsearch data that uses the data model prior to OpenShift Container Platform 4.5. You can configure per-project and global settings. Global settings apply to any project not specified. Per-project settings override global settings.
Cluster logging must be installed.
To delete indices:
Edit the OpenShift Container Platform custom Curator configuration file:
$ oc edit configmap/curator
Set the following parameters as needed:
config.yaml: |
project_name:
action
unit:value
The available parameters are:
Variable Name | Description |
---|---|
|
The actual name of a project, such as myapp-devel. For OpenShift Container Platform operations
logs, use the name |
|
The action to take, currently only |
|
The period to use for deletion, |
|
The number of units. |
Variable Name | Description |
---|---|
|
Use |
|
The list of regular expressions that match project names. |
|
The valid and properly escaped regular expression pattern enclosed by single quotation marks. |
For example, to configure Curator to:
Delete indices in the myapp-dev project older than 1 day
Delete indices in the myapp-qe project older than 1 week
Delete operations logs older than 8 weeks
Delete all other projects indices after they are 31 days
old
Delete indices older than 1 day that are matched by the ^project\..+\-dev.*$
regex
Delete indices older than 2 days that are matched by the ^project\..+\-test.*$
regex
Use:
config.yaml: |
.defaults:
delete:
days: 31
.operations:
delete:
weeks: 8
myapp-dev:
delete:
days: 1
myapp-qe:
delete:
weeks: 1
.regex:
- pattern: '^project\..+\-dev\..*$'
delete:
days: 1
- pattern: '^project\..+\-test\..*$'
delete:
days: 2
When you use |