Creating ClusterLogForwarder to send infrastructure logs to lokistack configured internal

[Nendir]

Hello Team,

I am working on configuring logging for my OpenShift cluster (version 4.19). I have set up a LokiStack internal to the cluster to monitor infrastructure logs on the OpenShift console.

I need guidance on:

Configuring ClusterLogForwarder to send infrastructure logs to the LokiStack.

Enabling the OpenShift Logging console plug-in on version 4.19.

The DO380 training covers version 4.14, which is now deprecated, so I am unable to rely on that.

I would greatly appreciate any urgent assistance you can provide.

Regards,

Nendir.

[donaldsebleung · Accepted solution]

DO380 v4.14 covers OpenShift Logging 5.9 which is deprecated and no longer supported in RHOCP 4.19. The latest supported version of OpenShift Logging on RHOCP 4.19 is 6.4 [1].

The high-level procedure for setting up OpenShift Logging 6.4 to forward infrastructure logs to LokiStack deployed on RHOCP 4.19 is described below [2].

1. Install Loki Operator 6.4 and create a LokiStack resource with S3-compatible object storage such as RHODF 4.19

2. Install Red Hat OpenShift Logging 6.4 and create a "logging-collector" ServiceAccount with the following cluster roles:

    a. logging-collector-logs-writer

    b. collect-application-logs - probably not required if you're collecting infrastructure logs only

    c. collect-infrastructure-logs

3. Create a ClusterLogForwarder resource with the following configuration:

    a. Use the "logging-collector" ServiceAccount

    b. Define an output "lokistack-out" for your LokiStack instance. The "default" output seen in v5.9 is deprecated and no longer available in v6.x

    c. Create a logging pipeline with "infrastructure" as an input reference and "lokistack-out" as an output reference

4. Install the Cluster Observability Operator (COO)

5. Define a UIPlugin resource "logging" of type "Logging" and point it to your LokiStack instance

6. Reload the web console and confirm that the "Observe > Logs" menu item is available and check that you can run LogQL queries

Note that the above high-level procedure is based solely on my limited understanding of the OpenShift Logging 6.4 documentation and I have not tested the procedure described above so take it with a grain of salt.

Thanks for raising this request as I would otherwise not have realized how much has changed since OpenShift Logging 5.9 (-:

References:

[1] OpenShift Operator Life Cycles: https://access.redhat.com/support/policy/updates/openshift_operators

[2] Chapter 1: Installing Logging: https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4/html/installing_logging/insta...

[Nendir]

Hello Donaldsebleung,

Thank you so much for your swift and detailed response.

This is very helpful.

I appreciate  

[Nendir]

Hello Donaldsebleung,

I am happy to inform you that i followed the steps highlighted on the documentation you shared and it was successful.

Infrastructure logs are now pushed to lokiStack and they are visible on my console.

Thank you once again.

Regards,

Nendir. 

[donaldsebleung]

You're welcome, glad to have helped!