Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OBSDOCS-1640: Document HTTP output proxy should be configurable #89407

Merged
merged 1 commit into from
Mar 6, 2025

Conversation

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 1, 2025
@openshift-ci-robot
Copy link

openshift-ci-robot commented Mar 1, 2025

@theashiot: This pull request references OBSDOCS-1640 which is a valid jira issue.

In response to this:

Version(s): 4.19

Issue: https://issues.redhat.com/browse/OBSDOCS-1640

Link to docs preview:

QE review:

  • QE has approved this change.

Additional information:
The changes are only to update the spec in yaml as compared to the previous release, published here:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sorry, something went wrong.

@openshift-ci openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Mar 1, 2025
@openshift-ci-robot
Copy link

openshift-ci-robot commented Mar 1, 2025

@theashiot: This pull request references OBSDOCS-1640 which is a valid jira issue.

In response to this:

Version(s): 4.19

Issue: https://issues.redhat.com/browse/OBSDOCS-1640

Link to docs preview:

QE review:

  • QE has approved this change.

Additional information:
The changes are only to update the spec in yaml as compared to the previous release, published here:

https://docs.openshift.com/container-platform/4.16/observability/logging/log_collection_forwarding/configuring-log-forwarding.html#logging-http-forward_configuring-log-forwarding

and

https://docs.openshift.com/container-platform/4.16/observability/logging/log_collection_forwarding/configuring-log-forwarding.html#cluster-logging-collector-log-forward-syslog_configuring-log-forwarding

Content improvements are beyond the scope of the Jira/PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sorry, something went wrong.

@ocpdocs-previewbot
Copy link

ocpdocs-previewbot commented Mar 1, 2025

🤖 Thu Mar 06 11:27:13 - Prow CI generated the docs preview:

https://89407--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/logging/logging-6.2/log6x-clf-6.2.html

@openshift-ci-robot
Copy link

openshift-ci-robot commented Mar 1, 2025

Sorry, something went wrong.

@theashiot
Copy link
Contributor Author

Hi @anpingli, i've incorporated the changes for http output that you provided here: https://github.com/openshift/openshift-docs/pull/88847/files#r1973684753

Also would you mind providing the complete example here: https://github.com/openshift/openshift-docs/pull/88847/files#r1973659586 to avoid back and forth :)

best,
ashwin

[id="cluster-logging-collector-log-forward-examples-syslog-log-source_{context}"]
== Adding log source information to message output

You can add `namespace_name`, `pod_name`, and `container_name` elements to the `message` field of the record by adding the `AddLogSource` field to your `ClusterLogForwarder` custom resource (CR).
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AddLogSource is replaced with "enrichment: KubernetesMinimal"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

replaced

<15>1 2020-11-15T17:06:14+00:00 fluentd-9hkb4 mytag - - - {"msgcontent"=>"Message Contents", "timestamp"=>"2020-11-15 17:06:09", "tag_key"=>"rec_tag", "index"=>56}
----

.Example syslog message output with `AddLogSource`
Copy link

@anpingli anpingli Mar 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Example: when enrichment: KubernetesMinimal

2025-03-03T11:42:31+00:00 anliazm3-m8hrk-worker-westus-djq2j syslogaosqersyslogserverd846bb9b: namespace_name=syslog-aosqe, container_name=rsyslog, pod_name=rsyslogserver-d846bb9bc-l2tjr, message={"@timestamp":"2025-03-03T11:42:31.862624122Z","facility":"local0","hostname":"anliazm3-m8hrk-worker-westus-djq2j","kubernetes":{"annotations":{"k8s.ovn.org/pod-networks":"{\"default\":{\"ip_addresses\":[\"10.129.2.40/23\"],\"mac_address\":\"0a:58:0a:81:02:28\",\"gateway_ips\":[\"10.129.2.1\"],\"routes\":[{\"dest\":\"10.128.0.0/14\",\"nextHop\":\"10.129.2.1\"},{\"dest\":\"172.30.0.0/16\",\"nextHop\":\"10.129.2.1\"},{\"dest\":\"169.254.169.5/32\",\"nextHop\":\"10.129.2.1\"},{\"dest\":\"100.64.0.0/16\",\"nextHop\":\"10.129.2.1\"}],\"ip_address\":\"10.129.2.40/23\",\"gateway_ip\":\"10.129.2.1\"}}","k8s.v1.cni.cncf.io/network-status":"[{\n    \"name\": \"ovn-kubernetes\",\n    \"interface\": \"eth0\",\n    \"ips\": [\n        \"10.129.2.40\"\n    ],\n    \"mac\": \"0a:58:0a:81:02:28\",\n    \"default\": true,\n    \"dns\": {}\n}]","openshift.io/generated-by":"OpenShiftNewApp","openshift.io/scc":"privileged"},"container_id":"cri-o://699290ce5f3af668ebebd1789d5df9bfb1af57ff2bbbeb6241f56af845bbec87","container_image":"quay.io/openshifttest/rsyslogd-container@sha256:e806eb41f05d7cc6eec96bf09c7bcb692f97562d4a983cb019289bd048d9aee2","container_image_id":"quay.io/openshifttest/rsyslogd-container@sha256:821f81c0deea63c4f06481e3773eac3f55892c69c91b3751b0ba61fb6decb905","container_iostream":"stderr","container_name":"rsyslog","labels":{"appname":"rsyslogserver","component":"rsyslogserver","pod-template-hash":"d846bb9bc","provider":"aosqe"},"namespace_id":"ec872692-4bde-45d3-ae4b-89ba35628a3d","namespace_labels":{"kubernetes_io_metadata_name":"syslog-aosqe","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_audit-version":"v1.24","pod-security_kubernetes_io_warn":"privileged","pod-security_kubernetes_io_warn-version":"v1.24"},"namespace_name":"syslog-aosqe","pod_id":"54a774f8-9e87-4867-b285-ef868cca6032","pod_ip":"10.129.2.40","pod_name":"rsyslogserver-d846bb9bc-l2tjr","pod_owner":"ReplicaSet/rsyslogserver-d846bb9bc"},"level":"default","log_source":"container","log_type":"application","message":"rsyslogd: netstream session 0x7f1a5ad94620 from 10.129.0.92 will be closed due to error [v8.2102.0-3.fc34 try https://www.rsyslog.com/e/2078 ]","openshift":{"cluster_id":"4fd3bf05-1e95-46cf-8480-62fc9435079c","sequence":1741002167861044318},"proc_id":"-","severity":"informational","tag":"syslogaosqersyslogserverd846bb9b","timestamp":"2025-03-03T11:42:31.862624122Z"}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated

This configuration is compatible with both RFC3164 and RFC5424.
====

.Example syslog message output without `AddLogSource`
Copy link

@anpingli anpingli Mar 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Example: when enrichment: None
`2025-03-03T11:48:01+00:00 anliazm3-m8hrk-worker-westus-jl26f syslogaosqersyslogserverd846bb9b: {"@timestamp":"2025-03-03T11:48:01.440861985Z","facility":"local0","hostname":"anliazm3-m8hrk-worker-westus-jl26f","kubernetes":{"annotations":{"k8s.ovn.org/pod-networks":"{"default":{"ip_addresses":["10.131.0.30/23"],"mac_address":"0a:58:0a:83:00:1e","gateway_ips":["10.131.0.1"],"routes":[{"dest":"10.128.0.0/14","nextHop":"10.131.0.1"},{"dest":"172.30.0.0/16","nextHop":"10.131.0.1"},{"dest":"169.254.169.5/32","nextHop":"10.131.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.131.0.1"}],"ip_address":"10.131.0.30/23","gateway_ip":"10.131.0.1"}}","k8s.v1.cni.cncf.io/network-status":"[{\n "name": "ovn-kubernetes",\n "interface": "eth0",\n "ips": [\n "10.131.0.30"\n ],\n "mac": "0a:58:0a:83:00:1e",\n "default": true,\n "dns": {}\n}]","openshift.io/generated-by":"OpenShiftNewApp","openshift.io/scc":"privileged"},"container_id":"cri-o://f8da362708b701483429bc448851438417ad654d304cbf302c9f26625b99aeed","container_image":"quay.io/openshifttest/rsyslogd-container@sha256:e806eb41f05d7cc6eec96bf09c7bcb692f97562d4a983cb019289bd048d9aee2","container_image_id":"quay.io/openshifttest/rsyslogd-container@sha256:821f81c0deea63c4f06481e3773eac3f55892c69c91b3751b0ba61fb6decb905","container_iostream":"stderr","container_name":"rsyslog","labels":{"appname":"rsyslogserver","component":"rsyslogserver","pod-template-hash":"d846bb9bc","provider":"aosqe"},"namespace_id":"ec872692-4bde-45d3-ae4b-89ba35628a3d","namespace_labels":{"kubernetes_io_metadata_name":"syslog-aosqe","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_audit-version":"v1.24","pod-security_kubernetes_io_warn":"privileged","pod-security_kubernetes_io_warn-version":"v1.24"},"namespace_name":"syslog-aosqe","pod_id":"25ce6cc5-79bd-46d0-a92c-22d573367e12","pod_ip":"10.131.0.30","pod_name":"rsyslogserver-d846bb9bc-vn4fk","pod_owner":"ReplicaSet/rsyslogserver-d846bb9bc"},"level":"default","log_source":"container","log_type":"application","message":"rsyslogd: error during parsing file /etc/rsyslog/conf/rsyslog.conf, on or before line 22: invalid character ''' - is there an invalid escape sequence somewhere? [v8.2102.0-3.fc34 try https://www.rsyslog.com/e/2207 ]","openshift":{"cluster_id":"4fd3bf05-1e95-46cf-8480-62fc9435079c","sequence":1741002487735423758},"proc_id":"-","severity":"informational","tag":"syslogaosqersyslogserverd846bb9b","timestamp":"2025-03-03T11:48:01.440861985Z"}

`

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated

<4> Values are either `true` or `false`.
<5> Secret name for destination credentials.
<6> This value should be the same as the output name.
<7> The name of your service account. The service account is only required in multi log forwarder implementations if the log forwarder is not deployed in the `openshift-logging` namespace.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In 6.2, service account must be specified.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

removed the line: "The service account is only required ..."

Copy link
Contributor Author

@theashiot theashiot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @anpingli for the review and the examples! I've made the changes. Mind having another look?

best,
ashwin

<4> Values are either `true` or `false`.
<5> Secret name for destination credentials.
<6> This value should be the same as the output name.
<7> The name of your service account. The service account is only required in multi log forwarder implementations if the log forwarder is not deployed in the `openshift-logging` namespace.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

removed the line: "The service account is only required ..."

[id="cluster-logging-collector-log-forward-examples-syslog-log-source_{context}"]
== Adding log source information to message output

You can add `namespace_name`, `pod_name`, and `container_name` elements to the `message` field of the record by adding the `AddLogSource` field to your `ClusterLogForwarder` custom resource (CR).
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

replaced

This configuration is compatible with both RFC3164 and RFC5424.
====

.Example syslog message output without `AddLogSource`
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated

<15>1 2020-11-15T17:06:14+00:00 fluentd-9hkb4 mytag - - - {"msgcontent"=>"Message Contents", "timestamp"=>"2020-11-15 17:06:09", "tag_key"=>"rec_tag", "index"=>56}
----

.Example syslog message output with `AddLogSource`
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated

severity: debug
tag: mytag
type: syslog
url: tls://syslog-receiver.openshift-logging.svc:24224
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest using 'tls://syslog-receiver.example.com:6514'.
In general, we use 514 as the syslog (TCP/UDP) port, and use 6514 as TLS port

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

<7> Set the RFC that the generated messages conform to. The value can be `RFC3164` or `RFC5424`.
<8> Set the severity level for the message. For more information, see link:https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.1[The Syslog Protocol].
<9> Set the delivery mode for log forwarding. The value can be either `AtLeastOnce`, or `AtMostOnce`.
<10> Specify the absolute URL with a scheme. Valid schemes are: `tcp`, `tls`, `udp` and `udps`. For example: `udps://syslog.example.com:1234`.
Copy link

@anpingli anpingli Mar 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please remove udps. we don't support udps. Maybe,that is a bug.

How about tls://syslog-receiver.example.com:6514
or udp://syslog-receiver.example.com:514

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated as tls://syslog-receiver.example.com:6514


.Example syslog message output with `enrichment: None`
[source, text]
----
Copy link

@anpingli anpingli Mar 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about remove some fileds from this example?

2025-03-03T11:48:01+00:00 anliazm3-m8hrk-worker-westus-jl26f syslogaosqersyslogserverd846bb9b: {xxx:xxx,yyyy:yyyy,.....}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated, wdyt?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, that is my expected.
we should highlight namespace_name, pod_name, and container_name in the example when enrichment is KubernetesMinimal

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done as discussed


[source, text]
----
2025-03-03T11:42:31+00:00 anliazm3-m8hrk-worker-westus-djq2j syslogaosqersyslogserverd846bb9b: namespace_name=syslog-aosqe, container_name=rsyslog, pod_name=rsyslogserver-d846bb9bc-l2tjr, message={"@timestamp":"2025-03-03T11:42:31.862624122Z","facility":"local0","hostname":"anliazm3-m8hrk-worker-westus-djq2j","kubernetes":{"annotations":{"k8s.ovn.org/pod-networks":"{\"default\":{\"ip_addresses\":[\"10.129.2.40/23\"],\"mac_address\":\"0a:58:0a:81:02:28\",\"gateway_ips\":[\"10.129.2.1\"],\"routes\":[{\"dest\":\"10.128.0.0/14\",\"nextHop\":\"10.129.2.1\"},{\"dest\":\"172.30.0.0/16\",\"nextHop\":\"10.129.2.1\"},{\"dest\":\"169.254.169.5/32\",\"nextHop\":\"10.129.2.1\"},{\"dest\":\"100.64.0.0/16\",\"nextHop\":\"10.129.2.1\"}],\"ip_address\":\"10.129.2.40/23\",\"gateway_ip\":\"10.129.2.1\"}}","k8s.v1.cni.cncf.io/network-status":"[{\n \"name\": \"ovn-kubernetes\",\n \"interface\": \"eth0\",\n \"ips\": [\n \"10.129.2.40\"\n ],\n \"mac\": \"0a:58:0a:81:02:28\",\n \"default\": true,\n \"dns\": {}\n}]","openshift.io/generated-by":"OpenShiftNewApp","openshift.io/scc":"privileged"},"container_id":"cri-o://699290ce5f3af668ebebd1789d5df9bfb1af57ff2bbbeb6241f56af845bbec87","container_image":"quay.io/openshifttest/rsyslogd-container@sha256:e806eb41f05d7cc6eec96bf09c7bcb692f97562d4a983cb019289bd048d9aee2","container_image_id":"quay.io/openshifttest/rsyslogd-container@sha256:821f81c0deea63c4f06481e3773eac3f55892c69c91b3751b0ba61fb6decb905","container_iostream":"stderr","container_name":"rsyslog","labels":{"appname":"rsyslogserver","component":"rsyslogserver","pod-template-hash":"d846bb9bc","provider":"aosqe"},"namespace_id":"ec872692-4bde-45d3-ae4b-89ba35628a3d","namespace_labels":{"kubernetes_io_metadata_name":"syslog-aosqe","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_audit-version":"v1.24","pod-security_kubernetes_io_warn":"privileged","pod-security_kubernetes_io_warn-version":"v1.24"},"namespace_name":"syslog-aosqe","pod_id":"54a774f8-9e87-4867-b285-ef868cca6032","pod_ip":"10.129.2.40","pod_name":"rsyslogserver-d846bb9bc-l2tjr","pod_owner":"ReplicaSet/rsyslogserver-d846bb9bc"},"level":"default","log_source":"container","log_type":"application","message":"rsyslogd: netstream session 0x7f1a5ad94620 from 10.129.0.92 will be closed due to error [v8.2102.0-3.fc34 try https://www.rsyslog.com/e/2078 ]","openshift":{"cluster_id":"4fd3bf05-1e95-46cf-8480-62fc9435079c","sequence":1741002167861044318},"proc_id":"-","severity":"informational","tag":"syslogaosqersyslogserverd846bb9b","timestamp":"2025-03-03T11:42:31.862624122Z"}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about remove some fileds from this example?

Copy link

@anpingli anpingli Mar 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2025-03-03T11:42:31+00:00 anliazm3-m8hrk-worker-westus-djq2j syslogaosqersyslogserverd846bb9b: namespace_name=syslog-aosqe, container_name=rsyslog, pod_name=rsyslogserver-d846bb9bc-l2tjr, message={xxx:xxx,yyyy:yyyy,.....}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done, wdtyt?

----

[id="cluster-logging-collector-log-forward-examples-syslog-parms_{context}"]
== Syslog parameters
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We had introduce these Syslog parameters above. I think we can drop the paragraph below

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

serviceAccount: # <14>
name: logcollector
----
<1> Specify a name for the output.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about add 'optional' from appName to tuning?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

Copy link
Contributor Author

@theashiot theashiot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @anpingli, i've made the required changes, have another look?

best,
ashwin

<7> Set the RFC that the generated messages conform to. The value can be `RFC3164` or `RFC5424`.
<8> Set the severity level for the message. For more information, see link:https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.1[The Syslog Protocol].
<9> Set the delivery mode for log forwarding. The value can be either `AtLeastOnce`, or `AtMostOnce`.
<10> Specify the absolute URL with a scheme. Valid schemes are: `tcp`, `tls`, `udp` and `udps`. For example: `udps://syslog.example.com:1234`.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated as tls://syslog-receiver.example.com:6514

severity: debug
tag: mytag
type: syslog
url: tls://syslog-receiver.openshift-logging.svc:24224
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done


.Example syslog message output with `enrichment: None`
[source, text]
----
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated, wdyt?


[source, text]
----
2025-03-03T11:42:31+00:00 anliazm3-m8hrk-worker-westus-djq2j syslogaosqersyslogserverd846bb9b: namespace_name=syslog-aosqe, container_name=rsyslog, pod_name=rsyslogserver-d846bb9bc-l2tjr, message={"@timestamp":"2025-03-03T11:42:31.862624122Z","facility":"local0","hostname":"anliazm3-m8hrk-worker-westus-djq2j","kubernetes":{"annotations":{"k8s.ovn.org/pod-networks":"{\"default\":{\"ip_addresses\":[\"10.129.2.40/23\"],\"mac_address\":\"0a:58:0a:81:02:28\",\"gateway_ips\":[\"10.129.2.1\"],\"routes\":[{\"dest\":\"10.128.0.0/14\",\"nextHop\":\"10.129.2.1\"},{\"dest\":\"172.30.0.0/16\",\"nextHop\":\"10.129.2.1\"},{\"dest\":\"169.254.169.5/32\",\"nextHop\":\"10.129.2.1\"},{\"dest\":\"100.64.0.0/16\",\"nextHop\":\"10.129.2.1\"}],\"ip_address\":\"10.129.2.40/23\",\"gateway_ip\":\"10.129.2.1\"}}","k8s.v1.cni.cncf.io/network-status":"[{\n \"name\": \"ovn-kubernetes\",\n \"interface\": \"eth0\",\n \"ips\": [\n \"10.129.2.40\"\n ],\n \"mac\": \"0a:58:0a:81:02:28\",\n \"default\": true,\n \"dns\": {}\n}]","openshift.io/generated-by":"OpenShiftNewApp","openshift.io/scc":"privileged"},"container_id":"cri-o://699290ce5f3af668ebebd1789d5df9bfb1af57ff2bbbeb6241f56af845bbec87","container_image":"quay.io/openshifttest/rsyslogd-container@sha256:e806eb41f05d7cc6eec96bf09c7bcb692f97562d4a983cb019289bd048d9aee2","container_image_id":"quay.io/openshifttest/rsyslogd-container@sha256:821f81c0deea63c4f06481e3773eac3f55892c69c91b3751b0ba61fb6decb905","container_iostream":"stderr","container_name":"rsyslog","labels":{"appname":"rsyslogserver","component":"rsyslogserver","pod-template-hash":"d846bb9bc","provider":"aosqe"},"namespace_id":"ec872692-4bde-45d3-ae4b-89ba35628a3d","namespace_labels":{"kubernetes_io_metadata_name":"syslog-aosqe","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_audit-version":"v1.24","pod-security_kubernetes_io_warn":"privileged","pod-security_kubernetes_io_warn-version":"v1.24"},"namespace_name":"syslog-aosqe","pod_id":"54a774f8-9e87-4867-b285-ef868cca6032","pod_ip":"10.129.2.40","pod_name":"rsyslogserver-d846bb9bc-l2tjr","pod_owner":"ReplicaSet/rsyslogserver-d846bb9bc"},"level":"default","log_source":"container","log_type":"application","message":"rsyslogd: netstream session 0x7f1a5ad94620 from 10.129.0.92 will be closed due to error [v8.2102.0-3.fc34 try https://www.rsyslog.com/e/2078 ]","openshift":{"cluster_id":"4fd3bf05-1e95-46cf-8480-62fc9435079c","sequence":1741002167861044318},"proc_id":"-","severity":"informational","tag":"syslogaosqersyslogserverd846bb9b","timestamp":"2025-03-03T11:42:31.862624122Z"}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done, wdtyt?

----

[id="cluster-logging-collector-log-forward-examples-syslog-parms_{context}"]
== Syslog parameters
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

serviceAccount: # <14>
name: logcollector
----
<1> Specify a name for the output.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

@openshift-ci-robot
Copy link

openshift-ci-robot commented Mar 4, 2025

Sorry, something went wrong.

@anpingli
Copy link

anpingli commented Mar 4, 2025

LGTM

@theashiot
Copy link
Contributor Author

Thanks a lot @anpingli for the review and excellent suggestions!

@theashiot
Copy link
Contributor Author

/label peer-review-needed

@openshift-ci openshift-ci bot added the peer-review-needed Signifies that the peer review team needs to review this PR label Mar 4, 2025
@GroceryBoyJr
Copy link
Contributor

/label peer-review-in-progress
/remove-label peer-review-needed
/assign GroceryBoyJr

@openshift-ci openshift-ci bot added peer-review-in-progress Signifies that the peer review team is reviewing this PR and removed peer-review-needed Signifies that the peer review team needs to review this PR labels Mar 4, 2025
Copy link
Contributor

@GroceryBoyJr GroceryBoyJr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only one small nit, otherwise, LGTM!

name: logcollector
----
<1> Specify a name for the output.
<2> Optional: Specify the value for the "APP-NAME" part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: foo-{.bar||"none"}.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Foobar, fubar, all variants are disallowed, since it is a term based on profanity.

https://www.ibm.com/docs/en/ibm-style?topic=word-usage#fubar

<3> Optional: Specify the value for "Facility" part of the MSGID part of the syslog-msg header.
<4> Optional: Specify the value for "MSGID" part of the MSGID part of the syslog-msg header. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 32 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: foo-{.bar||"none"}.
<5> Optional: Specify the record field to use as the payload. The PayloadKey value must be a single field path encased in single curly brackets `{}`. Example: {.bar}.
<6> Optional: Specify the value for the "PROCID" part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: foo-{.bar||"none"}.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

<1> Specify a name for the output.
<2> Optional: Specify the value for the "APP-NAME" part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: foo-{.bar||"none"}.
<3> Optional: Specify the value for "Facility" part of the MSGID part of the syslog-msg header.
<4> Optional: Specify the value for "MSGID" part of the MSGID part of the syslog-msg header. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 32 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: foo-{.bar||"none"}.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same, foobar disallowed.

@GroceryBoyJr
Copy link
Contributor

excellent work @theashiot , this is a big document and it looks great.

@GroceryBoyJr
Copy link
Contributor

/label peer-review-done
/remove-label peer-review-in-progress
/unassign GroceryBoyJr

@openshift-ci openshift-ci bot added peer-review-done Signifies that the peer review team has reviewed this PR and removed peer-review-in-progress Signifies that the peer review team is reviewing this PR labels Mar 4, 2025
@theashiot
Copy link
Contributor Author

Thanks, @GroceryBoyJr for the review! I've made all the required updates.

@theashiot
Copy link
Contributor Author

/label merge-review-needed

@openshift-ci openshift-ci bot added the merge-review-needed Signifies that the merge review team needs to review this PR label Mar 5, 2025
@skrthomas skrthomas added merge-review-in-progress Signifies that the merge review team is reviewing this PR and removed merge-review-needed Signifies that the merge review team needs to review this PR labels Mar 5, 2025
Copy link
Contributor

@skrthomas skrthomas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good, but I think there's a few things to tidy up before merging :) Please let me know if you have any questions!

name: logcollector
----
<1> Specify a name for the output.
<2> Optional: Specify the value for the "APP-NAME" part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<2> Optional: Specify the value for the "APP-NAME" part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
<2> Optional: Specify the value for the `appName` part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor Author

@theashiot theashiot Mar 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

changed to App-Name as this refers to the field in the RFC: https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.5

----
<1> Specify a name for the output.
<2> Optional: Specify the value for the "APP-NAME" part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
<3> Optional: Specify the value for "Facility" part of the MSGID part of the syslog-msg header.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<3> Optional: Specify the value for "Facility" part of the MSGID part of the syslog-msg header.
<3> Optional: Specify the value for `facility` part of the MSGID part of the syslog-msg header.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated to Facility and also removed extraneous "part of the MSGID" text

<1> Specify a name for the output.
<2> Optional: Specify the value for the "APP-NAME" part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
<3> Optional: Specify the value for "Facility" part of the MSGID part of the syslog-msg header.
<4> Optional: Specify the value for "MSGID" part of the MSGID part of the syslog-msg header. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 32 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<4> Optional: Specify the value for "MSGID" part of the MSGID part of the syslog-msg header. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 32 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
<4> Optional: Specify the value for `msgId` part of the syslog-msg header. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 32 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

backticks for this and I think maybe some duplicated text?

Copy link
Contributor Author

@theashiot theashiot Mar 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as MSGID per RFC and thanks for noticing the duplicated text, removed

<2> Optional: Specify the value for the "APP-NAME" part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
<3> Optional: Specify the value for "Facility" part of the MSGID part of the syslog-msg header.
<4> Optional: Specify the value for "MSGID" part of the MSGID part of the syslog-msg header. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 32 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
<5> Optional: Specify the record field to use as the payload. The PayloadKey value must be a single field path encased in single curly brackets `{}`. Example: {.<value>}.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<5> Optional: Specify the record field to use as the payload. The PayloadKey value must be a single field path encased in single curly brackets `{}`. Example: {.<value>}.
<5> Optional: Specify the record field to use as the payload. The `payloadKey` value must be a single field path encased in single curly brackets `{}`. Example: {.<value>}.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

<3> Optional: Specify the value for "Facility" part of the MSGID part of the syslog-msg header.
<4> Optional: Specify the value for "MSGID" part of the MSGID part of the syslog-msg header. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 32 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
<5> Optional: Specify the record field to use as the payload. The PayloadKey value must be a single field path encased in single curly brackets `{}`. Example: {.<value>}.
<6> Optional: Specify the value for the "PROCID" part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<6> Optional: Specify the value for the "PROCID" part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.
<6> Optional: Specify the value for the `procId` part of the syslog message header. The value must conform with link:https://datatracker.ietf.org/doc/html/rfc5424[The Syslog Protocol]. The value can be a combination of static and dynamic values consisting of field paths followed by `||`, and then followed by another field path or a static value. The maximum length of the final values is truncated to 48 characters. You must encase a dynamic value curly brackets and the value must be followed with a static fallback value separated with `||`. Static values can only contain alphanumeric characters along with dashes, underscores, dots and forward slashes. Example value: <value1>-{.<value2>||"none"}.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as PROCID

----

[id="cluster-logging-collector-log-forward-examples-syslog-log-source_{context}"]
== Adding log source information to message output
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
== Adding log source information to message output
== Adding log source information to the message output

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

Comment on lines 85 to 106
----
spec:
outputs:
- name: syslogout
syslog:
enrichment: KubernetesMinimal: true
facility: user
payloadKey: message
rfc: RFC3164
severity: debug
tag: mytag
type: syslog
url: tls://syslog-receiver.example.com:6514
pipelines:
- inputRefs:
- application
name: test-app
outputRefs:
- syslogout
----
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
----
spec:
outputs:
- name: syslogout
syslog:
enrichment: KubernetesMinimal: true
facility: user
payloadKey: message
rfc: RFC3164
severity: debug
tag: mytag
type: syslog
url: tls://syslog-receiver.example.com:6514
pipelines:
- inputRefs:
- application
name: test-app
outputRefs:
- syslogout
----
----
# ...
spec:
outputs:
- name: syslogout
syslog:
enrichment: KubernetesMinimal: true
facility: user
payloadKey: message
rfc: RFC3164
severity: debug
tag: mytag
type: syslog
url: tls://syslog-receiver.example.com:6514
pipelines:
- inputRefs:
- application
name: test-app
outputRefs:
- syslogout
# ...
----

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I notice that the spec is spaced over, probably because there's other parameters before. I would suggest using an elipses here to make that clearer, and maybe adding the context of what comes right before that spec would be orienting to customers too?

Copy link
Contributor Author

@theashiot theashiot Mar 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good point added "#..." at the beginning and at the end. As the example is about updating an existing CR, i don't think we need to add what comes before and after. TBH, I'll probably rewrite this with section as part of https://issues.redhat.com/browse/OBSDOCS-1747 because it is just showing the difference between

enrichment: KubernetesMinimal and enrichment: None

we have already covered this field in the earlier example. And i'm sure you can guess that this comes from legacy text! Lemme know your thoughts.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That sounds good, @theashiot ! Thanks for updating with the ellipses and the plan to spiff this up later.

Copy link

openshift-ci bot commented Mar 6, 2025

@theashiot: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@skrthomas skrthomas merged commit 07be8df into openshift:logging-docs-6.2 Mar 6, 2025
2 checks passed
@skrthomas
Copy link
Contributor

/cherrypick logging-docs-6.2-4.18

@openshift-cherrypick-robot

@skrthomas: new pull request created: #89738

In response to this:

/cherrypick logging-docs-6.2-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@skrthomas
Copy link
Contributor

/cherrypick logging-docs-6.2-4.17

@skrthomas
Copy link
Contributor

/cherrypick logging-docs-6.2-4.16

@openshift-cherrypick-robot

@skrthomas: new pull request created: #89739

In response to this:

/cherrypick logging-docs-6.2-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-cherrypick-robot

@skrthomas: new pull request created: #89740

In response to this:

/cherrypick logging-docs-6.2-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. merge-review-in-progress Signifies that the merge review team is reviewing this PR peer-review-done Signifies that the peer review team has reviewed this PR size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

7 participants