diff --git a/_topic_maps/_topic_map.yml b/_topic_maps/_topic_map.yml index 1bee7f72378c..5f01d2577153 100644 --- a/_topic_maps/_topic_map.yml +++ b/_topic_maps/_topic_map.yml @@ -45,7 +45,7 @@ Name: Upgrading logging Dir: upgrading Distros: openshift-logging Topics: -- Name: Upgrading to Logging 6.0 +- Name: Upgrading to Logging 6 File: upgrading-to-logging-60 --- Name: Uninstalling logging diff --git a/modules/changes-to-cluster-logging-and-forwarding-in-logging-6.adoc b/modules/changes-to-cluster-logging-and-forwarding-in-logging-6.adoc new file mode 100644 index 000000000000..6e0f4a081e32 --- /dev/null +++ b/modules/changes-to-cluster-logging-and-forwarding-in-logging-6.adoc @@ -0,0 +1,270 @@ +:_newdoc-version: 2.18.4 +:_template-generated: 2025-06-03 +:_mod-docs-content-type: CONCEPT + +[id="changes-to-cluster-logging-and-forwarding-in-logging-6_{context}"] += Changes to cluster logging and forwarding in Logging 6 + +Log collection and forwarding configurations are now specified under the new link:https://github.com/openshift/cluster-logging-operator/blob/master/docs/reference/operator/api_observability_v1.adoc[API], part of the `observability.openshift.io` API group. The following sections highlight the differences from the old API resources. + +[NOTE] +==== +Vector is the only supported collector implementation. +==== + +[id="management-resource-allocation-workload-scheduling_{context}"] +== Management, resource allocation, and workload scheduling + +Configuration for management state, resource requests and limits, tolerations, and node selection is now part of the new `ClusterLogForwarder` API. + +.Logging 5.x configuration +[source,yaml] +---- +apiVersion: "logging.openshift.io/v1" +kind: "ClusterLogging" +spec: + managementState: "Managed" + collection: + resources: + limits: {} + requests: {} + nodeSelector: {} + tolerations: {} +---- + +.Logging 6 configuration +[source,yaml] +---- +apiVersion: "observability.openshift.io/v1" +kind: ClusterLogForwarder +spec: + managementState: Managed + collector: + resources: + limits: {} + requests: {} + nodeSelector: {} + tolerations: {} +---- + +[id="input-specification_{context}"] +== Input specifications + +The input specification is an optional part of the `ClusterLogForwarder` specification. Administrators can continue to use the predefined values `application`, `infrastructure`, and `audit` to collect these sources. + +Namespace and container inclusions and exclusions have been consolidated into a single field. + +.5.x application input with namespace and container includes and excludes +[source,yaml] +---- +apiVersion: "logging.openshift.io/v1" +kind: ClusterLogForwarder +spec: + inputs: + - name: application-logs + type: application + application: + namespaces: + - foo + - bar + includes: + - namespace: my-important + container: main + excludes: + - container: too-verbose +---- + +.6.x application input with namespace and container includes and excludes +[source,yaml] +---- +apiVersion: "observability.openshift.io/v1" +kind: ClusterLogForwarder +spec: + inputs: + - name: application-logs + type: application + application: + includes: + - namespace: foo + - namespace: bar + - namespace: my-important + container: main + excludes: + - container: too-verbose +---- + +[NOTE] +==== +"application", "infrastructure", and "audit" are reserved words and cannot be used as names when defining an input. +==== + +Changes to input receivers include: + +* Explicit configuration of the type at the receiver level. +* Port settings moved to the receiver level. + +.5.x input receivers +[source,yaml] +---- +apiVersion: "logging.openshift.io/v1" +kind: ClusterLogForwarder +spec: + inputs: + - name: an-http + receiver: + http: + port: 8443 + format: kubeAPIAudit + - name: a-syslog + receiver: + type: syslog + syslog: + port: 9442 +---- + +.6.x input receivers +[source,yaml] +---- +apiVersion: "observability.openshift.io/v1" +kind: ClusterLogForwarder +spec: + inputs: + - name: an-http + type: receiver + receiver: + type: http + port: 8443 + http: + format: kubeAPIAudit + - name: a-syslog + type: receiver + receiver: + type: syslog + port: 9442 +---- + +[id="output-specification_{context}"] +== Output specifications + +High-level changes to output specifications include: + +* URL settings moved to each output type specification. +* Tuning parameters moved to each output type specification. +* Separation of TLS configuration from authentication. +* Explicit configuration of keys and secret/config map for TLS and authentication. + +[id="secrets-and-tls-configuration_{context}"] +== Secrets and TLS configuration + +Secrets and TLS configurations are now separated into authentication and TLS configuration for each output. They must be explicitly defined in the specification rather than relying on administrators to define secrets with recognized keys. Upgrading TLS and authorization configurations requires administrators to understand previously recognized keys to continue using existing secrets. The examples in this section illustrate how to configure `ClusterLogForwarder` secrets to forward to existing Red{nbsp}Hat managed log storage solutions. + +.Logging 6.x output configuration using service account token and config map +[source,yaml] +---- +... +spec: + outputs: + - lokiStack + authentication: + token: + from: serviceAccount + target: + name: logging-loki + namespace: openshift-logging + name: my-lokistack + tls: + ca: + configMapName: openshift-service-ca.crt + key: service-ca.crt + type: lokiStack +... +---- + +.Logging 6.x output authentication and TLS configuration using secrets +[source,yaml] +---- +... +spec: + outputs: + - name: my-output + type: http + http: + url: https://my-secure-output:8080 + authentication: + password: + key: pass + secretName: my-secret + username: + key: user + secretName: my-secret + tls: + ca: + key: ca-bundle.crt + secretName: collector + certificate: + key: tls.crt + secretName: collector + key: + key: tls.key + secretName: collector +... +---- + +[id="filters-and-pipeline-configuration_{context}"] +== Filters and pipeline configuration + +All attributes of pipelines in previous releases have been converted to filters in this release. Individual filters are defined in the `filters` spec and referenced by a pipeline. + +.5.x filters +[source,yaml] +---- +... +spec: + pipelines: + - name: app-logs + detectMultilineErrors: true + parse: json + labels: + : +... +---- + +.6.x filters and pipelines spec +[source,yaml] +---- +... +spec: + filters: + - name: my-multiline + type: detectMultilineException + - name: my-parse + type: parse + - name: my-labels + type: openshiftLabels + openshiftLabels: + :