Bug 2066397

Summary: [RHOSP16.1] logging-environment-rsyslog.yaml environment file support array of Elasticsearch targets
Product: Red Hat OpenStack Reporter: Dustin Ash <duash>
Component: openstack-tripleo-heat-templatesAssignee: Martin Magr <mmagr>
Status: CLOSED DUPLICATE QA Contact: Leonid Natapov <lnatapov>
Severity: low Docs Contact: Joanne O'Flynn <joflynn>
Priority: medium    
Version: 16.1 (Train)CC: jamsmith, lmadsen, mburns, mmagr, mrunge, ramishra, tkajinam
Target Milestone: z9Keywords: Triaged, ZStream
Target Release: 16.1 (Train on RHEL 8.2)   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Enhancement
Doc Text:
Feature: rsyslog environment configuration now supports an array of Elasticsearch targets. Reason: Prior releases only allowed a single target to be specified. Result: Multiple Elasticsearch targets can now be specified as a list of endpoints to send logs to.
 Story Points: ---
Clone Of:
: 2066905 (view as bug list) Environment:
Last Closed: 2022-03-22 19:44:30 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2066905, 2066908    

Description Dustin Ash 2022-03-21 16:45:32 UTC 
Description of problem:
Problem appears when customer uses the required format [1] on the logging-environment-rsyslog.yaml environment file, the overcloud deployment injects the Elasticsearch servers array in the following incorrect format to the rsyslog containers:  server="[10.28.26.224, 10.28.26.225, 10.28.26.226]" which is not supported by rsyslog and causes the following container error: 

rsyslogd: omelasticsearch: we are suspending ourselfs due to server failure 3: Host name '[10.28.26.224, 10.28.26.225, 10.28.26.226]' contains bad letter [v8.1911.0-3.el8 try https://www.rsyslog.com/e/2007 ] 

rsyslog configuration specifies the required format for an array of Elastisearch servers in [1]: server=["elasticsearch1", "elasticsearch2"]. When customer directly modifies the rsyslog container configuration using this specific format, rsyslog works properly and logs are sent to Elasticsearch. 


Version-Release number of selected component (if applicable):
openstack-tripleo-heat-templates-11.3.2-1.20210104205664.el8ost.2.noarch

How reproducible:


Steps to Reproduce:
1. Deploy with following syntax in logging-environment-rsyslog.yaml
    server: ["10.28.26.224", "10.28.26.225", "10.28.26.226"]


Actual results:
Incorrect format is deployed to the rsyslog containers:  
server="[10.28.26.224, 10.28.26.225, 10.28.26.226]" which is not supported by rsyslog and causes the following container error: 

rsyslogd: omelasticsearch: we are suspending ourselfs due to server failure 3: Host name '[10.28.26.224, 10.28.26.225, 10.28.26.226]' contains bad letter [v8.1911.0-3.el8 try https://www.rsyslog.com/e/2007 ] 



Expected results:
following format deployed to rsyslog containers:
server=["elasticsearch1", "elasticsearch2"]


Additional info:

Actual deployed
    server="[10.28.26.224, 10.28.26.225, 10.28.26.226]"
Expected deployed:
    server=["elasticsearch1", "elasticsearch2"]
Comment 6 Leif Madsen 2022-03-22 19:44:30 UTC 
Duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=1945334 which is resolved and will ship in the next z-stream release.

*** This bug has been marked as a duplicate of bug 1945334 ***