Chapter 9. Configure outputs

Forwards logs to Azure Monitor Logs service. This output requires a customer ID and shared key for authentication. You can specify a custom log type and associate logs with a specific Azure resource ID.

Forwards logs to a Red Hat managed LokiStack deployment by using the Red Hat OpenShift Logging tenancy model. This output integrates with Red Hat OpenShift Logging authentication and enforces multitenancy through the LokiStack gateway proxy. The collector automatically discovers the LokiStack service based on the namespace and name you specify.

Use case: Site reliability engineers and developers benefit from LokiStack for short-term troubleshooting and performance analysis. The built-in multitenancy ensures that developers can only access logs from their own namespaces.

Forwards logs by using the OpenTelemetry Protocol (OTLP) with Red Hat OpenShift Logging semantic conventions. This output sends logs in OTLP format over HTTP or HTTPS to OpenTelemetry collectors and observability backends that support OTLP ingestion.

Use case: Platform teams can forward logs to any observability platform that supports the OTLP protocol. Organizations can also use OpenTelemetry Collector as a central gateway to aggregate logs from multiple clusters before routing to final destinations. This approach provides vendor-neutral log forwarding and simplified multi-destination routing.

Forwards logs to Amazon S3 or S3-compatible object storage. This output supports the same authentication methods as CloudWatch (AWS access keys or IAM roles). You must specify the AWS region, bucket name, and key prefix pattern for organizing log objects. Use this output for long-term archival, compliance retention, or integration with data lake pipelines.

Use case: Security officers use S3 for immutable long-term retention of audit logs to meet compliance requirements. S3 bucket lifecycle policies can automatically move logs to cheaper storage tiers while maintaining the required retention period.

Forwards logs to Splunk HTTP Event Collector (HEC). This output requires a Splunk HEC token for authentication. You can configure custom index, source, and indexed fields to optimize Splunk search performance.

Use case: Developers and site reliability engineers often prefer Splunk because it is a familiar platform with powerful search and visualization capabilities. Organizations can route application and infrastructure logs to Splunk for operational analysis.