Switch to Lokistack

Instructions to switch from Elasticsearch Logging to Lokistack.

Migrating the logs isn’t part of this How-To, instead you can keep Elasticsearch logging until the retention time is expired. Then it’s safe to remove Elasticsearch Logging.

Running Lokistack and Elasticsearch Logging at the same time might exceed the resources of the infra nodes. Check in advance that you have enough resources available.

Keep Elasticsearch

To keep Elasticseach Logging just make sure the component is enabled:

components:
  elasticsearch:
    enabled: true

Enable Lokistack and make it default

Enable the Lokistack component:

components:
  elasticsearch:
    enabled: true (1)
  lokistack:
    enabled: true

clusterLogging:
  logStore:
    type: lokistack (2)

1	Keep the existing Elasticsearch
2	Make Lokistack the default logstore

Configure Lokistack

See the Lokistack parameters reference for configuration options.

Remove Elasticsearch

You might want to keep Elasticsearch Logging to access the logs until the retention time is expired.

Disable the Elasticsearch component:

components:
  elasticsearch:
    enabled: false

This will remove the subscriptions and the Kibana deployment.

Remove Deployments

The Elasticsearch deployment has to be removed manually.

Remove the Elasticsearch custom resource and pvc:

kubectl -n openshift-logging delete elasticsearches.logging.openshift.io elasticsearch
kubectl -n openshift-logging delete pvc -l logging-cluster=elasticsearch

Remove Operators

Verify that no other Elasticsearches, using this operator, exists:

kubectl get elasticsearches.logging.openshift.io -A

Remove the Elasticsearch operator:

kubectl -n openshift-operators-redhat delete csv -l operators.coreos.com/elasticsearch-operator.openshift-operators-redhat=""

Remove Custom Resource Definitions

Before you remove the CRDs, make sure no other deployments are using these resources.

The only thing left now are the CRDs from the Elasticsearch operator:

kubectl delete crd -l app.kubernetes.io/instance=elastic-operator