Bug 1641166 - Eventrouter creates duplicated events every 30 min with verb UPDATE
Summary: Eventrouter creates duplicated events every 30 min with verb UPDATE
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 3.10.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 3.10.z
Assignee: Noriko Hosoi
QA Contact: Qiaoling Tang
Depends On: 1613722
TreeView+ depends on / blocked
Reported: 2018-10-19 18:44 UTC by Noriko Hosoi
Modified: 2018-12-13 17:09 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: The eventrouter intentionally generates duplicate event logs rather not to lose them. Fix: Extended the elasticsearch_genid plugin to elasticsearch_genid_ext so that it takes the alt_key and alt_tag. If a log message has a tag matched the alt_tag value, it uses the alt_key value as the elasticsearch primary key. We could specify a field which is shared among the duplicate events to alt_key, which eliminates the duplicate events from the elasticsearch. Sample filter using elasticsearch_genid_ext @type elasticsearch_genid_ext hash_id_key viaq_msg_id alt_key kubernetes.event.metadata.uid alt_tags "#{ENV['GENID_ALT_TAG'] || 'kubernetes.var.log.containers.kube-eventrouter-*.** kubernetes.journal.container._default_.kubernetes.event'}" </filter> Result: There's no duplicate event logs indexed in the elasticsearch.
Clone Of: 1613722
Last Closed: 2018-12-13 17:09:08 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Github openshift origin-aggregated-logging pull 1437 None None None 2018-10-24 13:05:22 UTC
Red Hat Product Errata RHBA-2018:3750 None None None 2018-12-13 17:09:14 UTC

Comment 1 Jeff Cantrill 2018-10-24 13:05:22 UTC
3.10 pr https://github.com/openshift/origin-aggregated-logging/pull/1437

Comment 5 Qiaoling Tang 2018-11-29 08:34:40 UTC
Verified in logging-eventrouter-v3.10.79-1 logging-fluentd-v3.10.79-1

Comment 7 errata-xmlrpc 2018-12-13 17:09:08 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.