Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1945334

Summary: [OSP 16.1] Openstack Director deployment does not support multiple elasticsearch servers in the RsyslogElasticsearchSetting config
Product: Red Hat OpenStack Reporter: Matt Flusche <mflusche>
Component: puppet-rsyslogAssignee: Martin Magr <mmagr>
Status: CLOSED ERRATA QA Contact: Leonid Natapov <lnatapov>
Severity: high Docs Contact: Joanne O'Flynn <joflynn>
Priority: medium    
Version: 16.1 (Train)CC: csibbitt, duash, jamsmith, jbadiapa, lmadsen, mmagr, mrunge, tkajinam
Target Milestone: z9Keywords: Triaged
Target Release: 16.1 (Train on RHEL 8.2)   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: puppet-rsyslog-3.3.1-1.20220127123412.0c2b6c8.el8ost Doc Type: Enhancement
Doc Text:
With this update, the Rsyslog environment configuration supports an array of Elasticsearch targets. In previous releases, you could only specify a single target. You can now specify multiple Elasticsearch targets as a list of endpoints to send logs.
 Story Points: ---
Clone Of:
: 2015699 (view as bug list) Environment:
Last Closed: 2022-12-07 20:24:45 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2015699, 2066905, 2066908    

Description Matt Flusche 2021-03-31 17:24:30 UTC 
Description of problem:
From the rsyslog docs[1], multiple servers should be defined in the following array format:

 server=["elasticsearch1", "elasticsearch2"]

However, the puppet modules associated with this config doesn't seem to support this formatting.  In testing it will double quote the entire array which is invalid, example:

 server="["elasticsearch1", "elasticsearch2"]"
  

I've tested with a few variations and puppet always quotes the entire set. examples:

parameter_defaults:
  RsyslogElasticsearchSetting:
   server: '["192.168.0.11:9200", "192.168.0.12:9200"]'


parameter_defaults:
  RsyslogElasticsearchSetting:
    server: 
    -  192.168.0.11:9200
    -  192.168.0.12:9200


[1] - https://www.rsyslog.com/doc/v8-stable/configuration/modules/omelasticsearch.html#server

Version-Release number of selected component (if applicable):
16.1 current

How reproducible:
100%

Steps to Reproduce:
1.  Deploy overcloud with a list of elasticsearch servers.


Additional info:
Comment 2 Takashi Kajinami 2021-04-01 06:30:36 UTC 
The problem is that puppet-rsyslog always put "" around the value.
We should fix it so that it can accept Array.
 https://github.com/voxpupuli/puppet-rsyslog/blob/master/templates/action.epp#L29
Comment 13 Leif Madsen 2022-03-22 19:44:30 UTC 
*** Bug 2066397 has been marked as a duplicate of this bug. ***
Comment 18 Leonid Natapov 2022-11-06 10:59:58 UTC 
puppet-rsyslog-3.3.1-1.20220525153355.0c2b6c8.el8ost.noarch

custom yaml file:
parameter_defaults:
    RsyslogElasticsearchSetting:
        server: ["192.168.0.11:9200", "192.168.0.12:9200"]
        bulkmode: "on"

After deployment I can see servers populated in the conf file.



from: 50_openstack_logs.conf

# elasticsearch
action(type="omelasticsearch"
    name="elasticsearch"
    bulkmode="on"
    dynSearchIndex="on"
    errorfile="/var/log/rsyslog/omelasticsearch.log"
    searchIndex="rsyslog-node-index"
    server=["192.168.0.11:9200", "192.168.0.12:9200"]
    template="rsyslog-record"
Comment 27 errata-xmlrpc 2022-12-07 20:24:45 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenStack Platform 16.1.9 bug fix and enhancement advisory), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8795