Bug 1506286

Summary: [3.6] missing messages + [error]: record cannot use elasticsearch index name type project_full: record is missing kubernetes.namespace_id field:
Product: OpenShift Container Platform Reporter: Ruben Romero Montes <rromerom>
Component: LoggingAssignee: Jeff Cantrill <jcantril>
Status: CLOSED ERRATA QA Contact: Anping Li <anli>
Severity: high Docs Contact:
Priority: unspecified    
Version: 3.6.0CC: aos-bugs, jcantril, jmalde, mifiedle, mrobson, pportant, rmeggins, sgaikwad, smunilla
Target Milestone: ---Keywords: OpsBlocker
Target Release: 3.6.z   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Cause: Messages for which the unique namespace id could not be determined could not be properly indexed. Consequence: Messages could be lost and the error message appears in the logs Fix: Modify the cache algorithm to provide the necessary data or default the value to 'orphaned'. Result: The error message is resolved and messages are stored in an 'orphaned' index when a unique namespace id can not be determined.
Story Points: ---
Clone Of: 1500882 Environment:
Last Closed: 2018-04-12 05:59:07 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Comment 1 N. Harrison Ripps 2017-10-25 18:59:12 UTC
As with BZ1500882, this bug was targeted for 3.8.0 and then later was flagged as a test blocker for 3.7.0. Please sync up with QE; if this is a 3.70 test blocker, it has to be resolved now rather than in the 3.8.0 timeframe.

Comment 2 Jeff Cantrill 2018-02-13 18:39:16 UTC
Believe this to be resolved with the introduction of rubygem-fluent-plugin-kubernetes_metadata_filter-1.0.1-1.el7.noarch.rpm

Comment 4 Anping Li 2018-03-06 11:26:15 UTC
Verified and pass v3.6.173.0.104. .orphaned.2018.03.06 index are generated for none-namespace logs 

oc exec -c elasticsearch logging-es-data-master-u6uh7epq-1-d4kmm -- curl -s -XGET --cacert /etc/elasticsearch/secret/admin-ca --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key https://localhost:9200/_cat/indices?v
health status index                                                                pri rep docs.count docs.deleted store.size pri.store.size 
green  open   project.projecta11.d83d63c7-212e-11e8-9e98-0e7de6085d62.2018.03.06     1   0          2            0       26kb           26kb 
green  open   project.projecta4.a5af2724-212e-11e8-9e98-0e7de6085d62.2018.03.06      1   0          2            0       26kb           26kb 
green  open   project.projecta5.aceb448f-212e-11e8-9e98-0e7de6085d62.2018.03.06      1   0          2            0     26.1kb         26.1kb 
green  open   .kibana                                                                1   0          1            0        3kb            3kb 
green  open   project.logging.9275aebb-2104-11e8-98ca-0e7de6085d62.2018.03.06        1   0         14            0     48.5kb         48.5kb 
green  open   project.projecta18.0b36725b-212f-11e8-9e98-0e7de6085d62.2018.03.06     1   0          5            0     26.4kb         26.4kb 
green  open   .orphaned.2018.03.06                                                   1   0         10            0     26.4kb         26.4kb 
green  open   project.install-test.248200ed-2105-11e8-98ca-0e7de6085d62.2018.03.06   1   0       1582            0        1mb            1mb 
green  open   project.projecta13.e6e93b5e-212e-11e8-9e98-0e7de6085d62.2018.03.06     1   0          1            0     25.2kb         25.2kb 
green  open   .searchguard.logging-es-data-master-u6uh7epq                           1   0          5            0     30.5kb         30.5kb 
green  open   project.projecta7.bb565749-212e-11e8-9e98-0e7de6085d62.2018.03.06      1   0          1            0     23.3kb         23.3kb

Comment 7 errata-xmlrpc 2018-04-12 05:59:07 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1106