Bug 1945334 - [OSP 16.1] Openstack Director deployment does not support multiple elasticsearch servers in the RsyslogElasticsearchSetting config
Summary: [OSP 16.1] Openstack Director deployment does not support multiple elasticsea...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: puppet-rsyslog
Version: 16.1 (Train)
Hardware: x86_64
OS: Linux
medium
high
Target Milestone: z9
: 16.1 (Train on RHEL 8.2)
Assignee: Martin Magr
QA Contact: Leonid Natapov
Joanne O'Flynn
URL:
Whiteboard:
: 2066397 (view as bug list)
Depends On:
Blocks: 2015699 2066905 2066908
TreeView+ depends on / blocked
 
Reported: 2021-03-31 17:24 UTC by Matt Flusche
Modified: 2022-12-07 20:25 UTC (History)
8 users (show)

Fixed In Version: puppet-rsyslog-3.3.1-1.20220127123412.0c2b6c8.el8ost
Doc Type: Enhancement
Doc Text:
With this update, the Rsyslog environment configuration supports an array of Elasticsearch targets. In previous releases, you could only specify a single target. You can now specify multiple Elasticsearch targets as a list of endpoints to send logs.
Clone Of:
: 2015699 (view as bug list)
Environment:
Last Closed: 2022-12-07 20:24:45 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github voxpupuli puppet-rsyslog pull 184 0 None None None 2021-08-25 16:10:28 UTC
Red Hat Issue Tracker OSP-1688 0 None None None 2021-11-17 09:38:37 UTC
Red Hat Product Errata RHBA-2022:8795 0 None None None 2022-12-07 20:25:37 UTC

Description Matt Flusche 2021-03-31 17:24:30 UTC 
Description of problem:
From the rsyslog docs[1], multiple servers should be defined in the following array format:

 server=["elasticsearch1", "elasticsearch2"]

However, the puppet modules associated with this config doesn't seem to support this formatting.  In testing it will double quote the entire array which is invalid, example:

 server="["elasticsearch1", "elasticsearch2"]"
  

I've tested with a few variations and puppet always quotes the entire set. examples:

parameter_defaults:
  RsyslogElasticsearchSetting:
   server: '["192.168.0.11:9200", "192.168.0.12:9200"]'


parameter_defaults:
  RsyslogElasticsearchSetting:
    server: 
    -  192.168.0.11:9200
    -  192.168.0.12:9200


[1] - https://www.rsyslog.com/doc/v8-stable/configuration/modules/omelasticsearch.html#server

Version-Release number of selected component (if applicable):
16.1 current

How reproducible:
100%

Steps to Reproduce:
1.  Deploy overcloud with a list of elasticsearch servers.


Additional info:
Comment 2 Takashi Kajinami 2021-04-01 06:30:36 UTC 
The problem is that puppet-rsyslog always put "" around the value.
We should fix it so that it can accept Array.
 https://github.com/voxpupuli/puppet-rsyslog/blob/master/templates/action.epp#L29
Comment 13 Leif Madsen 2022-03-22 19:44:30 UTC 
*** Bug 2066397 has been marked as a duplicate of this bug. ***
Comment 18 Leonid Natapov 2022-11-06 10:59:58 UTC 
puppet-rsyslog-3.3.1-1.20220525153355.0c2b6c8.el8ost.noarch

custom yaml file:
parameter_defaults:
    RsyslogElasticsearchSetting:
        server: ["192.168.0.11:9200", "192.168.0.12:9200"]
        bulkmode: "on"

After deployment I can see servers populated in the conf file.



from: 50_openstack_logs.conf

# elasticsearch
action(type="omelasticsearch"
    name="elasticsearch"
    bulkmode="on"
    dynSearchIndex="on"
    errorfile="/var/log/rsyslog/omelasticsearch.log"
    searchIndex="rsyslog-node-index"
    server=["192.168.0.11:9200", "192.168.0.12:9200"]
    template="rsyslog-record"
Comment 27 errata-xmlrpc 2022-12-07 20:24:45 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenStack Platform 16.1.9 bug fix and enhancement advisory), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8795
Note You need to log in before you can comment on or make changes to this bug.