Chapter 12. Forward from pods and projects

Procedure

1. Create or edit a YAML file that defines the ClusterLogForwarder CR object:

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: collector
   spec:
     managementState: Managed
     outputs:
     - name: rsyslog-east
       syslog:
         appName: <app_name>
         enrichment: KubernetesMinimal
         facility: <facility_value>
         msgId: <message_ID>
         payloadKey: <record_field>
         procId: <process_ID>
         rfc: <RFC3164_or_RFC5424>
         severity: informational
         tuning:
           deliveryMode: <AtLeastOnce_or_AtMostOnce>
         url: <url>
       tls:
         ca:
           key: ca-bundle.crt
           secretName: syslog-secret
       type: syslog
     pipelines:
     - inputRefs:
       - application
       name: syslog-east
       outputRefs:
       - rsyslog-east
     serviceAccount:
       name: logcollector

   outputs.name

   Specify a name for the output.

   appName

   Optional: Specify the value for the APP-NAME part of the syslog message header. The value must conform with The Syslog Protocol. The value can be a combination of static and dynamic values consisting of field paths followed by ||, and then followed by another field path or a static value. The collector truncates the final values to a maximum length of 48 characters. You must encase a dynamic value in curly brackets and follow the value with a static fallback value separated with ||. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.

   enrichment

   Optional: Specify the enrichment level for Kubernetes metadata fields added to log records. The value can be KubernetesMinimal to add minimal Kubernetes fields such as namespace, pod name, and container name. This parameter replaces the addLogSource parameter that was removed in Logging 6.0.

   facility

   Optional: Specify the value for Facility part of the syslog-msg header.

   msgId

   Optional: Specify the value for MSGID part of the syslog-msg header. The value can be a combination of static and dynamic values consisting of field paths followed by ||, and then followed by another field path or a static value. The collector truncates the final values to a maximum length of 32 characters. You must encase a dynamic value in curly brackets and follow the value with a static fallback value separated with ||. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.

   payloadKey

   Optional: Specify the record field to use as the payload. The payloadKey value must be a single field path encased in single curly brackets {}. Example: {.<value>}.

   procId

   Optional: Specify the value for the PROCID part of the syslog message header. The value must conform with The Syslog Protocol. The value can be a combination of static and dynamic values consisting of field paths followed by ||, and then followed by another field path or a static value. The collector truncates the final values to a maximum length of 48 characters. You must encase a dynamic value in curly brackets and follow the value with a static fallback value separated with ||. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.

   rfc

   Optional: Set the RFC that the generated messages conform to. The value can be RFC3164 or RFC5424.

   severity

   Optional: Set the severity level for the message. For more information, see The Syslog Protocol.

   deliveryMode

   Optional: Set the delivery mode for log forwarding. The value can be either AtLeastOnce, or AtMostOnce.

   url

   Specify the absolute URL with a scheme. Valid schemes are: tcp, tls, and udp. For example: tls://syslog-receiver.example.com:6514.

   tls

   Specify the settings for controlling options of the transport layer security (TLS) client connections.

   inputRefs

   Specify which log types to forward by using the pipeline: application, infrastructure, or audit.

   pipelines.name

   Specify a name for the pipeline.

   serviceAccount

   The name of your service account.

2. Create the CR object:

   $ oc create -f <filename>.yaml