Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions api/observability/v1/zz_generated.deepcopy.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

46 changes: 45 additions & 1 deletion bundle/manifests/cluster-logging.clusterserviceversion.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ metadata:
categories: OpenShift Optional, Logging & Tracing, Observability
certified: "false"
containerImage: quay.io/openshift-logging/cluster-logging-operator:latest
createdAt: "2025-04-08T15:35:39Z"
createdAt: "2025-04-22T11:06:54Z"
description: The Red Hat OpenShift Logging Operator for OCP provides a means for
configuring and managing log collection and forwarding.
features.operators.openshift.io/cnf: "false"
Expand Down Expand Up @@ -1449,6 +1449,50 @@ spec:
path: outputs[0].splunk.index
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:text
- description: |-
IndexedFields are the list of fields to be indexed by Splunk, increase storage usage, they should be used sparingly and only for high-value fields that provide significant search benefits.
Nested fields are flattened into top-level fields.
Field paths are joined using dot notation, and unsupported characters are replaced with underscores (_).
Non-string values are automatically converted to strings (e.g., 3 → "3", true → "true").
Object values serialized as JSON strings (e.g., { status: 200 } → "{\"status\":200}").

Examples: [`.kubernetes`, `.log_type`, '.kubernetes.labels.foobar', `.kubernetes.labels."foo-bar/baz"`]
displayName: Indexed Fields
path: outputs[0].splunk.indexedFields
- description: |-
PayloadKey specifies record field to use as payload.
The PayloadKey must be a single field path.

Field paths must only contain alphanumeric and underscores. Any field with other characters must be quoted.

By default, payloadKey is not set, which means the complete log record is forwarded as the payload.
Use payloadKey carefully. Selecting a single field as the payload may cause other important information in the
log to be dropped, potentially leading to inconsistent or incomplete log events.

Examples: `.kubernetes`, `.log_type`, '.kubernetes.labels.foobar', `.kubernetes.labels."foo-bar/baz"`
displayName: Payload Key
path: outputs[0].splunk.payloadKey
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:text
- description: |-
Source identifies the origin of a log event.
The Source can be a combination of static and dynamic values consisting of field paths followed by `||` followed by another field path or a static value.
A dynamic value is encased in single curly brackets `{}` and MUST end with a static fallback value separated with `||`.
Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes.
If not specified will be detected according to .log_source and .log_type value.
Details see in: docs/features/logforwarding/outputs/splunk-forwarding.adoc

Example:

1. foo-{.bar||"none"}

2. {.foo||.bar||"missing"}

3. foo.{.bar.baz||.qux.quux.corge||.grault||"nil"}-waldo.fred{.plugh||"none"}
displayName: Source
path: outputs[0].splunk.source
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:text
- description: Tuning specs tuning for the output
displayName: Tuning Options
path: outputs[0].splunk.tuning
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -1333,7 +1333,7 @@ spec:
NOTE2: If this filter is used in a pipeline with GoogleCloudLogging, `.hostname` CANNOT be added to this list as it is a required field.
items:
description: |-
FieldPath represents a path to find a value for a given field. The format must a value that can be converted to a
FieldPath represents a path to find a value for a given field. The format must be a value that can be converted to a
valid collector configuration. It is a dot delimited path to a field in the log record. It must start with a `.`.
The path can contain alphanumeric characters and underscores (a-zA-Z0-9_).
If segments contain characters outside of this range, the segment must be quoted.
Expand Down Expand Up @@ -1366,7 +1366,7 @@ spec:
NOTE2: If this filter is used in a pipeline with GoogleCloudLogging, `.hostname` MUST be added to this list as it is a required field.
items:
description: |-
FieldPath represents a path to find a value for a given field. The format must a value that can be converted to a
FieldPath represents a path to find a value for a given field. The format must be a value that can be converted to a
valid collector configuration. It is a dot delimited path to a field in the log record. It must start with a `.`.
The path can contain alphanumeric characters and underscores (a-zA-Z0-9_).
If segments contain characters outside of this range, the segment must be quoted.
Expand Down Expand Up @@ -3184,6 +3184,58 @@ spec:
3. foo.{.bar.baz||.qux.quux.corge||.grault||"nil"}-waldo.fred{.plugh||"none"}
pattern: ^(([a-zA-Z0-9-_.\/])*(\{(\.[a-zA-Z0-9_]+|\."[^"]+")+((\|\|)(\.[a-zA-Z0-9_]+|\.?"[^"]+")+)*\|\|"[^"]*"\})*)*$
type: string
indexedFields:
description: |-
IndexedFields are the list of fields to be indexed by Splunk, increase storage usage, they should be used sparingly and only for high-value fields that provide significant search benefits.
Nested fields are flattened into top-level fields.
Field paths are joined using dot notation, and unsupported characters are replaced with underscores (_).
Non-string values are automatically converted to strings (e.g., 3 → "3", true → "true").
Object values serialized as JSON strings (e.g., { status: 200 } → "{\"status\":200}").

Examples: [`.kubernetes`, `.log_type`, '.kubernetes.labels.foobar', `.kubernetes.labels."foo-bar/baz"`]
items:
description: |-
FieldPath represents a path to find a value for a given field. The format must be a value that can be converted to a
valid collector configuration. It is a dot delimited path to a field in the log record. It must start with a `.`.
The path can contain alphanumeric characters and underscores (a-zA-Z0-9_).
If segments contain characters outside of this range, the segment must be quoted.
Examples: `.kubernetes.namespace_name`, `.log_type`, '.kubernetes.labels.foobar', `.kubernetes.labels."foo-bar/baz"`
pattern: ^(\.[a-zA-Z0-9_]+|\."[^"]+")(\.[a-zA-Z0-9_]+|\."[^"]+")*$
type: string
nullable: true
type: array
payloadKey:
description: |-
PayloadKey specifies record field to use as payload.
The PayloadKey must be a single field path.

Field paths must only contain alphanumeric and underscores. Any field with other characters must be quoted.

By default, payloadKey is not set, which means the complete log record is forwarded as the payload.
Use payloadKey carefully. Selecting a single field as the payload may cause other important information in the
log to be dropped, potentially leading to inconsistent or incomplete log events.

Examples: `.kubernetes`, `.log_type`, '.kubernetes.labels.foobar', `.kubernetes.labels."foo-bar/baz"`
pattern: ^(\.[a-zA-Z0-9_]+|\."[^"]+")(\.[a-zA-Z0-9_]+|\."[^"]+")*$
type: string
source:
description: |-
Source identifies the origin of a log event.
The Source can be a combination of static and dynamic values consisting of field paths followed by `||` followed by another field path or a static value.
A dynamic value is encased in single curly brackets `{}` and MUST end with a static fallback value separated with `||`.
Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes.
If not specified will be detected according to .log_source and .log_type value.
Details see in: docs/features/logforwarding/outputs/splunk-forwarding.adoc

Example:

1. foo-{.bar||"none"}

2. {.foo||.bar||"missing"}

3. foo.{.bar.baz||.qux.quux.corge||.grault||"nil"}-waldo.fred{.plugh||"none"}
pattern: ^(([a-zA-Z0-9-_.\/])*(\{(\.[a-zA-Z0-9_]+|\."[^"]+")+((\|\|)(\.[a-zA-Z0-9_]+|\.?"[^"]+")+)*\|\|"[^"]*"\})*)*$
type: string
tuning:
description: Tuning specs tuning for the output
nullable: true
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -1333,7 +1333,7 @@ spec:
NOTE2: If this filter is used in a pipeline with GoogleCloudLogging, `.hostname` CANNOT be added to this list as it is a required field.
items:
description: |-
FieldPath represents a path to find a value for a given field. The format must a value that can be converted to a
FieldPath represents a path to find a value for a given field. The format must be a value that can be converted to a
valid collector configuration. It is a dot delimited path to a field in the log record. It must start with a `.`.
The path can contain alphanumeric characters and underscores (a-zA-Z0-9_).
If segments contain characters outside of this range, the segment must be quoted.
Expand Down Expand Up @@ -1366,7 +1366,7 @@ spec:
NOTE2: If this filter is used in a pipeline with GoogleCloudLogging, `.hostname` MUST be added to this list as it is a required field.
items:
description: |-
FieldPath represents a path to find a value for a given field. The format must a value that can be converted to a
FieldPath represents a path to find a value for a given field. The format must be a value that can be converted to a
valid collector configuration. It is a dot delimited path to a field in the log record. It must start with a `.`.
The path can contain alphanumeric characters and underscores (a-zA-Z0-9_).
If segments contain characters outside of this range, the segment must be quoted.
Expand Down Expand Up @@ -3184,6 +3184,58 @@ spec:
3. foo.{.bar.baz||.qux.quux.corge||.grault||"nil"}-waldo.fred{.plugh||"none"}
pattern: ^(([a-zA-Z0-9-_.\/])*(\{(\.[a-zA-Z0-9_]+|\."[^"]+")+((\|\|)(\.[a-zA-Z0-9_]+|\.?"[^"]+")+)*\|\|"[^"]*"\})*)*$
type: string
indexedFields:
description: |-
IndexedFields are the list of fields to be indexed by Splunk, increase storage usage, they should be used sparingly and only for high-value fields that provide significant search benefits.
Nested fields are flattened into top-level fields.
Field paths are joined using dot notation, and unsupported characters are replaced with underscores (_).
Non-string values are automatically converted to strings (e.g., 3 → "3", true → "true").
Object values serialized as JSON strings (e.g., { status: 200 } → "{\"status\":200}").

Examples: [`.kubernetes`, `.log_type`, '.kubernetes.labels.foobar', `.kubernetes.labels."foo-bar/baz"`]
items:
description: |-
FieldPath represents a path to find a value for a given field. The format must be a value that can be converted to a
valid collector configuration. It is a dot delimited path to a field in the log record. It must start with a `.`.
The path can contain alphanumeric characters and underscores (a-zA-Z0-9_).
If segments contain characters outside of this range, the segment must be quoted.
Examples: `.kubernetes.namespace_name`, `.log_type`, '.kubernetes.labels.foobar', `.kubernetes.labels."foo-bar/baz"`
pattern: ^(\.[a-zA-Z0-9_]+|\."[^"]+")(\.[a-zA-Z0-9_]+|\."[^"]+")*$
type: string
nullable: true
type: array
payloadKey:
description: |-
PayloadKey specifies record field to use as payload.
The PayloadKey must be a single field path.

Field paths must only contain alphanumeric and underscores. Any field with other characters must be quoted.

By default, payloadKey is not set, which means the complete log record is forwarded as the payload.
Use payloadKey carefully. Selecting a single field as the payload may cause other important information in the
log to be dropped, potentially leading to inconsistent or incomplete log events.

Examples: `.kubernetes`, `.log_type`, '.kubernetes.labels.foobar', `.kubernetes.labels."foo-bar/baz"`
pattern: ^(\.[a-zA-Z0-9_]+|\."[^"]+")(\.[a-zA-Z0-9_]+|\."[^"]+")*$
type: string
source:
description: |-
Source identifies the origin of a log event.
The Source can be a combination of static and dynamic values consisting of field paths followed by `||` followed by another field path or a static value.
A dynamic value is encased in single curly brackets `{}` and MUST end with a static fallback value separated with `||`.
Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes.
If not specified will be detected according to .log_source and .log_type value.
Details see in: docs/features/logforwarding/outputs/splunk-forwarding.adoc

Example:

1. foo-{.bar||"none"}

2. {.foo||.bar||"missing"}

3. foo.{.bar.baz||.qux.quux.corge||.grault||"nil"}-waldo.fred{.plugh||"none"}
pattern: ^(([a-zA-Z0-9-_.\/])*(\{(\.[a-zA-Z0-9_]+|\."[^"]+")+((\|\|)(\.[a-zA-Z0-9_]+|\.?"[^"]+")+)*\|\|"[^"]*"\})*)*$
type: string
tuning:
description: Tuning specs tuning for the output
nullable: true
Expand Down
44 changes: 44 additions & 0 deletions config/manifests/bases/cluster-logging.clusterserviceversion.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -1372,6 +1372,50 @@ spec:
path: outputs[0].splunk.index
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:text
- description: |-
IndexedFields are the list of fields to be indexed by Splunk, increase storage usage, they should be used sparingly and only for high-value fields that provide significant search benefits.
Nested fields are flattened into top-level fields.
Field paths are joined using dot notation, and unsupported characters are replaced with underscores (_).
Non-string values are automatically converted to strings (e.g., 3 → "3", true → "true").
Object values serialized as JSON strings (e.g., { status: 200 } → "{\"status\":200}").

Examples: [`.kubernetes`, `.log_type`, '.kubernetes.labels.foobar', `.kubernetes.labels."foo-bar/baz"`]
displayName: Indexed Fields
path: outputs[0].splunk.indexedFields
- description: |-
PayloadKey specifies record field to use as payload.
The PayloadKey must be a single field path.

Field paths must only contain alphanumeric and underscores. Any field with other characters must be quoted.

By default, payloadKey is not set, which means the complete log record is forwarded as the payload.
Use payloadKey carefully. Selecting a single field as the payload may cause other important information in the
log to be dropped, potentially leading to inconsistent or incomplete log events.

Examples: `.kubernetes`, `.log_type`, '.kubernetes.labels.foobar', `.kubernetes.labels."foo-bar/baz"`
displayName: Payload Key
path: outputs[0].splunk.payloadKey
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:text
- description: |-
Source identifies the origin of a log event.
The Source can be a combination of static and dynamic values consisting of field paths followed by `||` followed by another field path or a static value.
A dynamic value is encased in single curly brackets `{}` and MUST end with a static fallback value separated with `||`.
Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes.
If not specified will be detected according to .log_source and .log_type value.
Details see in: docs/features/logforwarding/outputs/splunk-forwarding.adoc

Example:

1. foo-{.bar||"none"}

2. {.foo||.bar||"missing"}

3. foo.{.bar.baz||.qux.quux.corge||.grault||"nil"}-waldo.fred{.plugh||"none"}
displayName: Source
path: outputs[0].splunk.source
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:text
- description: Tuning specs tuning for the output
displayName: Tuning Options
path: outputs[0].splunk.tuning
Expand Down