Bug 1866146

Description of problem:

$ oc logs fluentd-9cqz6 
Setting each total_size_limit for 1 buffers to 19242572390 bytes
Setting queued_chunks_limit_size for each buffer to 2293
Setting chunk_limit_size for each buffer to 8388608
2020-08-05 01:44:03 +0000 [warn]: parameter 'pos_file_compaction_interval' in <source>
  @type tail
  @id container-input
  path "/var/log/containers/*.log"
  exclude_path ["/var/log/containers/fluentd-*_openshift-logging_*.log","/var/log/containers/elasticsearch-*_openshift-logging_*.log","/var/log/containers/kibana-*_openshift-logging_*.log"]
  pos_file "/var/log/es-containers.log.pos"
  pos_file_compaction_interval 1800
  refresh_interval 5
  rotate_wait 5
  tag "kubernetes.*"
  read_from_head true
  @label @CONCAT
  <parse>
    @type "multi_format"
    <pattern>
      format json
      time_format "%Y-%m-%dT%H:%M:%S.%N%Z"
      keep_time_key true
      time_type string
    </pattern>
    <pattern>
      format regexp
      expression /^(?<time>.+) (?<stream>stdout|stderr)( (?<logtag>.))? (?<log>.*)$/
      time_format "%Y-%m-%dT%H:%M:%S.%N%:z"
      keep_time_key true
    </pattern>
  </parse>
</source> is not used.
2020-08-05 01:44:03 +0000 [warn]: parameter 'pos_file_compaction_interval' in <source>
  @type tail
  @id audit-input
  @label @INGRESS
  path "/var/log/audit/audit.log"
  pos_file "/var/log/audit/audit.log.pos"
  pos_file_compaction_interval 1800
  tag "linux-audit.log"
  <parse>
    @type "viaq_host_audit"
  </parse>
</source> is not used.
2020-08-05 01:44:03 +0000 [warn]: parameter 'pos_file_compaction_interval' in <source>
  @type tail
  @id k8s-audit-input
  @label @INGRESS
  path "/var/log/kube-apiserver/audit.log"
  pos_file "/var/log/kube-apiserver/audit.log.pos"
  pos_file_compaction_interval 1800
  tag "k8s-audit.log"
  <parse>
    @type "json"
    time_key "requestReceivedTimestamp"
    keep_time_key true
    time_format "%Y-%m-%dT%H:%M:%S.%N%z"
    time_type string
  </parse>
</source> is not used.
2020-08-05 01:44:03 +0000 [warn]: parameter 'pos_file_compaction_interval' in <source>
  @type tail
  @id openshift-audit-input
  @label @INGRESS
  path "/var/log/openshift-apiserver/audit.log"
  pos_file "/var/log/openshift-apiserver/audit.log.pos"
  pos_file_compaction_interval 1800
  tag "openshift-audit.log"
  <parse>
    @type "json"
    time_key "requestReceivedTimestamp"
    keep_time_key true
    time_format "%Y-%m-%dT%H:%M:%S.%N%z"
    time_type string
  </parse>
</source> is not used.
2020-08-05 01:44:03 +0000 [warn]: parameter 'undefined_to_replace_char' in <filter **>
  @type viaq_data_model
  elasticsearch_index_prefix_field "viaq_index_name"
  default_keep_fields CEE,time,@timestamp,aushape,ci_job,collectd,docker,fedora-ci,file,foreman,geoip,hostname,ipaddr4,ipaddr6,kubernetes,level,message,namespace_name,namespace_uuid,offset,openstack,ovirt,pid,pipeline_metadata,rsyslog,service,systemd,tags,testcase,tlog,viaq_msg_id
  extra_keep_fields 
  keep_empty_fields message
  use_undefined false
  undefined_name "undefined"
  rename_time true
  rename_time_if_missing false
  src_time_name "time"
  dest_time_name "@timestamp"
  pipeline_type collector
  undefined_to_string false
  undefined_to_replace_char UNUSED
  undefined_max_num_fields -1
  process_kubernetes_events false
  <formatter>
    tag "system.var.log**"
    type sys_var_log
    remove_keys "host,pid,ident"
  </formatter>
  <formatter>
    tag "journal.system**"
    type sys_journal
    remove_keys "log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID"
  </formatter>
  <formatter>
    tag "kubernetes.journal.container**"
    type k8s_journal
    remove_keys "log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID"
  </formatter>
  <formatter>
    tag "kubernetes.var.log.containers.eventrouter-** kubernetes.var.log.containers.cluster-logging-eventrouter-** k8s-audit.log** openshift-audit.log**"
    type k8s_json_file
    remove_keys "log,stream,CONTAINER_ID_FULL,CONTAINER_NAME"
    process_kubernetes_events true
  </formatter>
  <formatter>
    tag "kubernetes.var.log.containers**"
    type k8s_json_file
    remove_keys "log,stream,CONTAINER_ID_FULL,CONTAINER_NAME"
  </formatter>
  <elasticsearch_index_name>
    enabled true
    tag "journal.system** system.var.log** **_default_** **_kube-*_** **_openshift-*_** **_openshift_**"
    name_type static
    static_index_name "infra-write"
  </elasticsearch_index_name>
  <elasticsearch_index_name>
    enabled true
    tag "linux-audit.log** k8s-audit.log** openshift-audit.log**"
    name_type static
    static_index_name "audit-write"
  </elasticsearch_index_name>
  <elasticsearch_index_name>
    enabled true
    tag "**"
    name_type static
    static_index_name "app-write"
  </elasticsearch_index_name>
</filter> is not used.


CLF CR instance:
spec:
  outputs:
  - name: fluentd-created-by-user
    secret:
      name: fluentdserver
    type: fluentdForward
    url: tls://fluentdserver.fluentd.svc:24224
  pipelines:
  - inputRefs:
    - infrastructure
    - application
    - audit
    name: forward-to-fluentd-server
    outputRefs:
    - fluentd-created-by-user


Version-Release number of selected component (if applicable):
clusterlogging.4.6.0-202008040110.p0   

How reproducible:
Always

Steps to Reproduce:
1. deploy logging
2. enable CLF
3. check fluentd pod log

Actual results:


Expected results:


Additional info: