Chapter 5. Deployment scenarios overview

OpenShift Logging uses a modular architecture where you choose which components to deploy:

The three most common deployment patterns combine these components in different ways.

Components: Vector collector

What this scenario provides:

Common configurations:

What you manage:

In this scenario, your cluster does not store logs locally. All log data leaves the cluster and goes to external systems. You query and visualize logs by using those external platforms (Splunk UI, CloudWatch Logs Insights, Grafana connected to external Loki, and so on).

Components: Vector collector + Loki log store

What this scenario provides:

Common configurations:

What you manage:

In this scenario, logs are stored both locally (in Loki) and optionally forwarded externally. You query local logs by using external tools that understand the Loki API, such as Grafana. The OpenShift web console does not have log querying capabilities unless you also install the Cluster Observability Operator.

Components: Vector collector + Loki log store + Cluster Observability Operator

What this scenario provides:

Common configurations:

What you manage:

In this scenario, the OpenShift web console becomes your primary interface for log queries. A "Logs" tab appears where you can write LogQL queries, filter by namespace or pod, and correlate log data with metrics and traces without leaving the browser.

The choice between these scenarios depends on several factors:

For detailed guidance on choosing a scenario, including resource requirements, cost implications, and decision criteria, see the Plan section.