Bug 1981579

Summary: [4.6] The built-in application type can not forward all the logs when sending specific namespace logs
Product: OpenShift Container Platform Reporter: Keiichi Kii (NEC) <kkii>
Component: LoggingAssignee: Jeff Cantrill <jcantril>
Status: CLOSED ERRATA QA Contact: Anping Li <anli>
Severity: high Docs Contact:
Priority: high    
Version: 4.6CC: aconway, aos-bugs, jcantril, jniu
Target Milestone: ---   
Target Release: 4.6.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: logging-core
Fixed In Version: 4.6 Doc Type: Bug Fix
Doc Text:
Before this update, <X problem> caused <Y situation> (OPTIONAL: under the following <Z conditions>). With this update, <fix> resolves the issue (OPTIONAL: and <agent> can <perform operation> successfully).
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-08-04 19:49:45 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Keiichi Kii (NEC) 2021-07-12 21:22:18 UTC
a) Description of problem:

While sending specific namespace logs to an external aggregator as well as send logs to
internal OCP Elasticsearch(default) using the built-in application, the internal OCP ES
can not see the specific namespace logs.

b) Version-Release number of selected component (if applicable):

OpenShift 4.7 and OpenShift Logging 5.0

c) How reproducible:

Always when sending specific namespace logs

d) Steps to Reproduce:

1. Deploy OpenShift Logging(Elasticsearch operator and OpenShift Logging Operator)
2. Create a cluster logging instance
3. Configure ClusterLogForwarder with the following yaml
~~~
apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: instance
spec:
  inputs:
    - application:
        namespaces:
         - test
      name: test-app-logs
  outputs:
   - name: rsyslog
     type: syslog
     syslog:
       facility: local0
       severity: informational
     url: 'udp://<rsyslog server>'
  pipelines:
    - name: application-default
      inputRefs:
        - application
      outputRefs:
        - default
    - name: forward-to-syslog
      inputRefs:
        - test-app-logs
      outputRefs:
        - rsyslog
~~~
4. Check the forwarded logs from the "application-default" pipeline

e) Actual results:
The forwarded logs from the built-in "application" doesn't include the specific namespace logs

f) Expected results:
All the application logs should be forwarded using the built-in application 
type while sending specific namespace logs

g) Additional info:

In OpenShift Logging 5.1 or later, this behavior is changed to send all the application
logs while sending specific namespace logs by the following commit:

https://github.com/openshift/cluster-logging-operator/pull/999

But, as for OpenShift Logging 5.1 and later, the namespace filtering feature is
changed based on label router plugin.
So we can not cherry-pick cluster-logging-operator#999 to 5.0 and 4.6 simply.

The following PR is the change for OpenShift Logging 5.0.
It depends on https://github.com/openshift/cluster-logging-operator/pull/976.

Comment 4 Anping Li 2021-07-28 09:43:40 UTC
Verified on clusterlogging.4.6.0-202107232145

Comment 6 errata-xmlrpc 2021-08-04 19:49:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6.41 extras update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:2889