a) Description of problem: While sending specific namespace logs to an external aggregator as well as send logs to internal OCP Elasticsearch(default) using the built-in application, the internal OCP ES can not see the specific namespace logs. b) Version-Release number of selected component (if applicable): OpenShift 4.7 and OpenShift Logging 5.0 c) How reproducible: Always when sending specific namespace logs d) Steps to Reproduce: 1. Deploy OpenShift Logging(Elasticsearch operator and OpenShift Logging Operator) 2. Create a cluster logging instance 3. Configure ClusterLogForwarder with the following yaml ~~~ apiVersion: logging.openshift.io/v1 kind: ClusterLogForwarder metadata: name: instance spec: inputs: - application: namespaces: - test name: test-app-logs outputs: - name: rsyslog type: syslog syslog: facility: local0 severity: informational url: 'udp://<rsyslog server>' pipelines: - name: application-default inputRefs: - application outputRefs: - default - name: forward-to-syslog inputRefs: - test-app-logs outputRefs: - rsyslog ~~~ 4. Check the forwarded logs from the "application-default" pipeline e) Actual results: The forwarded logs from the built-in "application" doesn't include the specific namespace logs f) Expected results: All the application logs should be forwarded using the built-in application type while sending specific namespace logs g) Additional info: In OpenShift Logging 5.1 or later, this behavior is changed to send all the application logs while sending specific namespace logs by the following commit: https://github.com/openshift/cluster-logging-operator/pull/999 But, as for OpenShift Logging 5.1 and later, the namespace filtering feature is changed based on label router plugin. So we can not cherry-pick cluster-logging-operator#999 to 5.0 and 4.6 simply. The following PR is the change for OpenShift Logging 5.0. It depends on https://github.com/openshift/cluster-logging-operator/pull/976.
Verified on clusterlogging.4.6.0-202107232145
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.6.41 extras update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:2889