Chapter 7. Configure inputs

Procedure

1. Add a configuration to include or exclude the namespace and container names in the ClusterLogForwarder CR.

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   # ...
   spec:
     serviceAccount:
       name: <service_account_name>
     inputs:
       - name: mylogs
         application:
           includes:
             - namespace: "my-project"
               container: "my-container"
           excludes:
             - container: "other-container*"
               namespace: "other-namespace"
         type: application
   # ...

   includes.namespace

   Specifies that the logs are only collected from these namespaces.

   includes.container

   Specifies that the logs are only collected from these containers.

   excludes.namespace

   Specifies the pattern of namespaces to ignore when collecting the logs.

   excludes.container

   Specifies the set of containers to ignore when collecting the logs.

   Note

   The excludes field takes precedence over the includes field.

2. Apply the ClusterLogForwarder CR by running the following command:

   $ oc apply -f <filename>.yaml

Procedure

1. Add a configuration for a filter to the input spec in the ClusterLogForwarder CR.

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   # ...
   spec:
     serviceAccount:
       name: <service_account_name>
     inputs:
       - name: mylogs
         application:
           selector:
             matchExpressions:
             - key: env
               operator: In
               values: ["prod", "qa"]
             - key: zone
               operator: NotIn
               values: ["east", "west"]
             matchLabels:
               app: one
               name: app1
         type: application
   # ...

   matchExpressions.key

   Specifies the label key to match.

   matchExpressions.operator

   Specifies the operator. Valid values include: In, NotIn, Exists, and DoesNotExist.

   matchExpressions.values

   Specifies an array of string values. If the operator value is either Exists or DoesNotExist, the value array must be empty.

   matchLabels

   Specifies an exact key and value mapping.

2. Apply the ClusterLogForwarder CR by running the following command:

   $ oc apply -f <filename>.yaml

Procedure

1. Add a configuration to define the audit and infrastructure sources in the ClusterLogForwarder CR.

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   # ...
   spec:
     serviceAccount:
       name: <service_account_name>
     inputs:
       - name: mylogs1
         type: infrastructure
         infrastructure:
           sources:
             - node
       - name: mylogs2
         type: audit
         audit:
           sources:
             - kubeAPI
             - openshiftAPI
             - ovn
   # ...

   infrastructure.sources

   Specifies the list of infrastructure sources to collect. The valid sources include:

   • node: Journal log from the node
   • container: Logs from the workloads deployed in the namespaces

   audit.sources

   Specifies the list of audit sources to collect. The valid sources include:

   • kubeAPI: Logs from the Kubernetes API servers
   • openshiftAPI: Logs from the OpenShift API servers
   • auditd: Logs from a node auditd service
   • ovn: Logs from an open virtual network service

2. Apply the ClusterLogForwarder CR by running the following command:

   $ oc apply -f <filename>.yaml

Procedure

1. Grant the collector service account permission to collect audit logs:

   $ oc adm policy add-cluster-role-to-user collect-audit-logs \
     system:serviceaccount:<namespace>:<service_account_name>

   Replace <namespace> with the namespace where your ClusterLogForwarder CR is deployed and <service_account_name> with the name you specified in the ClusterLogForwarder CR spec.serviceAccount.name field.

2. Add audit to the inputRefs list in your ClusterLogForwarder pipeline by editing the CR:

   $ oc edit clusterlogforwarder <clusterlogforwarder_name> -n <namespace>

   Replace <clusterlogforwarder_name> with the name of your ClusterLogForwarder CR and <namespace> with the namespace where it is deployed.

   Note

   In Logging versions before 5.9, the ClusterLogForwarder CR was a singleton named instance in the openshift-logging namespace. Starting in Logging 5.9, you can create multiple ClusterLogForwarder CRs with different names in different namespaces.

   Example configuration

   spec:
     # ... other configuration
     outputs:
     - name: default-loki
       # ... output configuration
     pipelines:
     - name: my-pipeline
       inputRefs:
       - application
       - infrastructure
       - audit
       outputRefs:
       - default-loki

3. Verify that the ClusterLogForwarder still shows Ready by running the following command:

   $ oc get clusterlogforwarder <clusterlogforwarder_name> -n <namespace> \
     -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}'

   Replace <clusterlogforwarder_name> with the name of your ClusterLogForwarder CR and <namespace> with the namespace where it is deployed.

   The output should show True.

4. Verify that the Authorized condition lists audit by running the following command:

   $ oc get clusterlogforwarder <clusterlogforwarder_name> -n <namespace> \
     -o jsonpath='{.status.conditions[?(@.type=~"Authorized")].message}'

   Example output

   permitted to collect log types: [application audit infrastructure]