Parameters

The parent key for all of the following parameters is openshift4_logging.

See the OpenShift docs for details.

`namespace`

type	string
default	`openshift-logging`

The namespace in which to install the operator.

`version`

type	string
default	`5.8`

The logging stack version to deploy. This parameter is used in the default values for parameters channel and alerts.

We recommend that you use this parameter to specify the logging stack version which the component should deploy. However, you can still parameters channel and alerts directly.

See the OpenShift Logging life cycle documentation for supported versions of the logging stack. We recommend that you select a version of the logging stack that’s officially listed as compatible with your OpenShift version.

`channel`

type	string
default	`stable-${openshift4_logging:version}`

Channel of the operator subscription to use. If you specify the logging stack version through parameter version, you shouldn’t need to modify this parameter.

In OpenShift 4.7, RedHat decoupled the logging stack version from the OpenShift version. The decoupled logging stack versions start at version 5.0. With version 5.1 of the logging stack, channels for specific minor versions were introduced.

Ideally we would just default to the stable channel, as that channel will always be backed by a logging stack version compatible with the OpenShift cluster version by the OpenShift marketplace operator. However, since there’s potential for changes in configuration between logging stack versions which need to be managed through the component, we default to using the stable-5.x channel matching the version specified in parameter version.

See the OpenShift documentation for details.

`alerts`

type	string
default	`release-${openshift4_logging:version}`

Release version of the alerting rules. If you specify the logging stack version through parameter version, you shouldn’t need to modify this parameter.

The component uses this parameter to determine the version to download for both Elasticsearch Operator and fluentd alert rules.

Generally, the value for parameter alerts should match the value for parameter channel: if you specify channel: stable-5.5, you should use alerts: release-5.5.

RedHat moved the YAML file containing the alert rules between cluster-logging version 5.4 and 5.5. To ensure the component can deploy alert rules for version 5.5, we’ve implemented support for the different file locations through a lookup map in the component class. However, due to limitations of reclass, there’s no way to specify a fallback value in case the lookup map doesn’t contain a key. Because of this, the component no longer automatically supports new versions of the logging stack.

`ignore_alerts`

type	list
default	[]

This parameter can be used to disable alerts provided by openshift cluster-logging-operator. The component supports removing entries in this parameter by providing the entry prefixed with ~.

`patch_alerts`

type	dictionary
default	`patch_alerts: FluentdQueueLengthIncreasing: for: '12h'`

The parameter patch_alerts allows users to customize upstream alerts.

`components.elasticsearch`

type	dictionary
default	`components: elasticsearch: enabled: false kibana_host: null predict_elasticsearch_storage_alert: enabled: true lookback_range: 72h predict_hours_from_now: 72 threshold: 85 for: 6h severity: warning`

Configuration of the elasticsearch component.

Elasticsearch is deprecated.

`components.elasticsearch.kibana_host`

type	string
default	`null`
example	`kibana.apps.cluster.syn.tools`

Host name of the Kibana route.

`components.elasticsearch.predict_elasticsearch_storage_alert`

type	dict
example	`components: elasticsearch: predict_elasticsearch_storage_alert: enabled: true lookback_range: 72h predict_hours_from_now: 72 threshold: 85 for: 6h severity: warning`

Create an alert SYN_ElasticsearchExpectNodeToReachDiskWatermark if the storage allocated for Elasticsearch is predicted to reach the low storage watermark.

`components.elasticsearch.predict_elasticsearch_storage_alert.enabled`

type	boolean
default	`true`

Enable or disable this alert.

`components.elasticsearch.predict_elasticsearch_storage_alert.lookback_range`

type	prometheus duration
default	`72h`

How for to look back to calculate the prediction.

`components.elasticsearch.predict_elasticsearch_storage_alert.predict_hours_from_now`

type	number
default	`72`

How far in the future the prediction is calculated.

`components.elasticsearch.predict_elasticsearch_storage_alert.threshold`

type	number
default	`85`

The threshold for the alert. Percentage of disk fill.

`components.elasticsearch.predict_elasticsearch_storage_alert.for`

type	prometheus duration
default	`6h`

The alert is firing once the threshold has been reached for this long.

`components.elasticsearch.predict_elasticsearch_storage_alert.severity`

type	string
default	`warning`

The severity of the fired alert.

`components.lokistack`

Configuration of the lokistack component. See subsections for supported keys.

`components.lokistack.enabled`

type	boolean
default	`true`

Whether to deploy the LokiStack on the cluster.

`components.lokistack.clusterReaderLogAccess`

type	list
default	`- application - infrastructure`

A list of log categories (supported values are application, infrastructure and audit) which can be viewed by users which have cluster-reader permissions. Entries in the list can be removed in the hierarchy by prefixing them with ~.

We don’t grant access to audit logs to cluster-reader by default since audit logs can contain sensitive information.

`components.lokistack.logStore`

type	dictionary
default	`logStore: access_key_id: '' access_key_secret: '' endpoint: '' bucketnames: '${cluster:name}-logstore'`

A dictionary holding the connection information for the s3 storage used by the lokistack.

See the Openshift Docs or Lokistack Operator Docs for available parameters.

`components.lokistack.spec`

type

dictionary

default

spec:
  size: 1x.extra-small
  storage:
    schemas:
      - version: v13
        effectiveDate: '2022-09-01'
    secret:
      type: s3
      name: loki-logstore
  storageClassName: ''
  tenants:
    mode: openshift-logging
  limits:
    global:
      ingestion:
        ingestionBurstSize: 9 (1)
        ingestionRate: 5 (2)

1	value in MiB (per push event)
2	value in MiB/s

A dictionary holding the .spec for the LokiStack resource.

The component configures fluentd as the default log forwarder. The default chunk size limit in fluentd is 8 MiB which the burst size limit of 9 MiB accounts for. The ingestion rate defines the MiB/s limit for a tenant. OpenShift Logging uses the following three tenants:

application
audit
infrastructure

The max allowed volume for a tenant per day can be calculated with the following formula:

\$"volumePerDay"_"tenant" ("in GiB/s") = ("ingestionRate"_"tenant" ("in MiB/s") * 60 * 60 * 24) / 1024\$

The default of 5 MiB/s allows up to ~420 GiB of logs per day for a tenant.

See the Openshift Docs for available parameters. See the Loki Operator Docs for available Lokistack specs.

`components.logmetrics`

Configuration of the logfile metrics component. See subsections for supported keys.

`components.logmetrics.enabled`

type	boolean
default	`false`

Whether to deploy the LogFileMetricsExporter on the cluster.

`components.logmetrics.spec`

type

dictionary

default

spec:
  nodeSelector: (1)
    node-role.kubernetes.io/infra: ''
  resources: (2)
    limits:
      cpu: 500m
      memory: 256Mi
    requests:
      cpu: 200m
      memory: 128Mi

1	configure nodeSelector
2	configure resources

See the LogCollection Docs for available specs.

`operatorResources`

type	dictionary
default	see `defaults.yml`

A dictionary holding the .spec.config.resources for OLM subscriptions maintained by this component.

`clusterLogging`

type	dictionary
default	{}

A dictionary holding the .spec for cluster logging.

See the OpenShift docs for available parameters.

`clusterLogForwarder`

type	dictionary
default	{}

A dictionary holding the .spec for cluster log forwarding.

See the OpenShift docs for available parameters.

`clusterLogForwarding`

clusterLogForwarding is deprecated, please use clusterLogForwarder

`namespaceLogForwarderEnabled`

type	bool
default	false

Enabling namespaced log forwarding requires redeploying the logging operator. See How-To for instructions.

`namespaceLogForwarder`

type	dictionary
default	{}

A dictionary holding the .spec for namespaced log forwarding.

See in examples below for configuration.

`secrets`

type	dict
default	`{}`

A dict of secrets to create in the namespace. The key is the name of the secret, the value is the content of the secret. The value must be a dict with a key stringData which is a dict of key/value pairs to add to the secret.

Examples

clusterLogging:
  logStore:
    retentionPolicy:
      application:
        maxAge: 15d
    elasticsearch:
      nodeCount: 5

Use namespaced ClusterLogForwarder

Example creates a ClusterLogForwarder, ServiceAccount and RoleBinding in namespace my-namespace.

namespaceLogForwarderEnabled: true
namespaceLogForwarder:
  my-namespace/my-forwarder:
    outputs:
      splunk-forwarder:
        secret:
          name: splunk-forwarder
        type: fluentdForward
        url: tls://splunk-forwarder:24224
    pipelines:
      application-logs:
        inputRefs:
          - application
        outputRefs:
          - splunk-forwarder

Forward logs for all application logs to third-party

clusterLogForwarder:
  outputs:
    splunk-forwarder:
      secret:
        name: splunk-forwarder
      type: fluentdForward
      url: tls://splunk-forwarder:24224
  pipelines:
    application-logs:
      outputRefs:
        - splunk-forwarder

Forward logs for certain namespaces to third-party

clusterLogForwarder:
  inputs:
    my-apps:
      application:
        namespaces:
          - my-namespace
  outputs:
    splunk-forwarder:
      secret:
        name: splunk-forwarder
      type: fluentdForward
      url: tls://splunk-forwarder:24224
  pipelines:
    my-apps:
      inputRefs:
        - my-apps
      outputRefs:
        - splunk-forwarder

Enable JSON parsing for all application logs

clusterLogForwarder:
  pipelines:
    application-logs:
      parse: json

Enable JSON parsing for certain namespaces

clusterLogForwarder:
  inputs:
    my-apps:
      application:
        namespaces:
          - my-namespace
  pipelines:
    my-apps:
      inputRefs:
        - my-apps
      outputRefs:
        - default
      parse: json