Chapter 3. Plan your logging installation


Plan your logging deployment by understanding the available operators, deployment scenarios, and how to choose the right combination for your use case.

3.1. Logging operator overview

Red Hat OpenShift Logging provides three Operators to deploy and manage logging. Each Operator manages a distinct layer of the logging stack:

Loki Operator
Installs into the openshift-operators-redhat namespace. Manages the log store: receives, indices, and stores logs in S3-compatible object storage by using a LokiStack instance.
Red Hat OpenShift Logging Operator
Installs into the openshift-logging namespace. Manages log collection and forwarding: tails container logs and ships them to the log store by using a ClusterLogForwarder instance.
Cluster Observability Operator (COO)
Installs into the openshift-cluster-observability-operator namespace. Manages visualization: adds the Logs tab to the web console under Observe Logs by using a UIPlugin instance.

3.2. Choose which operators to install

The Operators you need depend on your use case:

  • Collect and forward logs to a third-party log store: Install only the Red Hat OpenShift Logging Operator.
  • Store logs in-cluster with LokiStack: Install the Loki Operator first, then the Red Hat OpenShift Logging Operator.
  • Store logs in-cluster and visualize them in the web console: Install all three operators in this order:

    1. Loki Operator
    2. Red Hat OpenShift Logging Operator
    3. Cluster Observability Operator (COO)
Important
  • You must install and configure the Loki Operator before configuring the Red Hat OpenShift Logging Operator.
  • The Loki Operator and the Red Hat OpenShift Logging Operator must use the same major and minor version. For example, both operators must be on stable-6.6.

3.3. Deployment scenarios

Select your deployment scenario to determine the required storage backend and sizing.

Cloud deployment (AWS, GCP, Azure)
  • Storage backend: Use cloud-managed object storage (S3, GCS, Azure Blob Storage)
  • TLS CA bundle: Typically not required when using standard public endpoints. Required when using custom endpoints, VPC endpoints, or private link configurations with custom certificates.
  • Authentication: Configure IAM roles (AWS STS recommended) or service accounts
  • Sizing: Start with 1x.pico or 1x.extra-small for development, 1x.small or 1x.medium for production
On-premise deployment (bare metal, VMware)
  • Storage backend: Deploy S3 Compatible storage (NetApp StorageGRID and others), Ceph RGW, or use enterprise S3-compatible storage
  • TLS CA bundle: Required when using self-signed certificates or internal certificate authorities. Not required when using publicly trusted certificates.
  • Authentication: Create Kubernetes secret with storage credentials
  • Sizing: Start with 1x.extra-small for development, 1x.small or 1x.medium for production
Edge deployment (single-node clusters, remote sites)
  • Storage backend: Forward logs to central cluster with LokiStack, or use local S3 Compatible storage with limited retention
  • StorageClass: Must configure Local Storage Operator or Logical Volume Manager Storage for persistent volumes
  • Sizing: Use 1x.pico or 1x.extra-small with short retention (7-14 days)
  • Consider: Log forwarding to central hub instead of local storage for capacity-constrained nodes
Multi-cluster or enterprise deployment
  • Storage backend: Centralized object storage with multi-region replication
  • Sizing: 1x.medium or larger, with ruler enabled for alerting and retention policies
  • Consider: Separate LokiStack instances per environment (dev/staging/prod) or centralized aggregation
Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

Legal Notice

Theme

© 2026 Red Hat
Back to top