Cloudwatch

REST over HTTP(S)

✓

✓

Elasticsearch v6

v6.8.1

✓

✓

Elasticsearch v7

v7.12.2, 7.17.7

✓

✓

Elasticsearch v8

v8.4.3

✓

Fluent Forward

Fluentd forward v1

Fluentd 1.14.6, Logstash 7.10.1

✓

Google Cloud Logging

✓

HTTP

HTTP 1.1

Fluentd 1.14.6, Vector 0.21

Kafka

Kafka 0.11

Kafka 2.4.1, 2.7.0, 3.3.1

✓

✓

Loki

REST over HTTP(S)

Loki 2.3.0, 2.7

✓

✓

Splunk

HEC

v8.2.9, 9.0.0

✓

Syslog

RFC3164, RFC5424

Rsyslog 8.37.0-9.el7

✓

App container logs

✓

✓

App-specific routing

✓

✓

App-specific routing by namespace

✓

✓

Infra container logs

✓

✓

Infra journal logs

✓

✓

Kube API audit logs

✓

✓

OpenShift API audit logs

✓

✓

Open Virtual Network (OVN) audit logs

✓

✓

Elasticsearch certificates

✓

✓

Elasticsearch username / password

✓

✓

Cloudwatch keys

✓

✓

Cloudwatch STS

✓

✓

Kafka certificates

✓

✓

Kafka username / password

✓

✓

Kafka SASL

✓

✓

Loki bearer token

✓

✓

Viaq data model - app

✓

✓

Viaq data model - infra

✓

✓

Viaq data model - infra(journal)

✓

✓

Viaq data model - Linux audit

✓

✓

Viaq data model - kube-apiserver audit

✓

✓

Viaq data model - OpenShift API audit

✓

✓

Viaq data model - OVN

✓

✓

Loglevel Normalization

✓

✓

JSON parsing

✓

✓

Structured Index

✓

✓

Multiline error detection

✓

Multicontainer / split indices

✓

✓

Flatten labels

✓

✓

CLF static labels

✓

✓

Fluentd readlinelimit

✓

Fluentd buffer

✓

- chunklimitsize

✓

- totallimitsize

✓

- overflowaction

✓

- flushthreadcount

✓

- flushmode

✓

- flushinterval

✓

- retrywait

✓

- retrytype

✓

- retrymaxinterval

✓

- retrytimeout

✓

Metrics

✓

✓

Dashboard

✓

✓

Alerts

✓

Global proxy support

✓

✓

x86 support

✓

✓

ARM support

✓

✓

IBM Power support

✓

✓

IBM zSystems support

✓

✓

IPv6 support

✓

✓

Log event buffering

✓

Disconnected Cluster

✓

✓

spec

object

Specification of the desired behavior of ClusterLogForwarder

status

object

Status of the ClusterLogForwarder

inputs

array

(optional) Inputs are named filters for log messages to be forwarded.

outputDefaults

object

(optional) DEPRECATED OutputDefaults specify forwarder config explicitly for the default store.

outputs

array

(optional) Outputs are named destinations for log messages.

pipelines

array

Pipelines forward the messages selected by a set of inputs to a set of outputs.

application

object

(optional) Application, if present, enables named set of application logs that

name

string

Name used to refer to the input of a pipeline.

namespaces

array

(optional) Namespaces from which to collect application logs.

selector

object

(optional) Selector for logs from pods with matching labels.

matchLabels

object

(optional) matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels

elasticsearch

object

(optional) Elasticsearch OutputSpec default values

enableStructuredContainerLogs

bool

(optional) EnableStructuredContainerLogs enables multi-container structured logs to allow

structuredTypeKey

string

(optional) StructuredTypeKey specifies the metadata key to be used as name of elasticsearch index

structuredTypeName

string

(optional) StructuredTypeName specifies the name of elasticsearch schema

syslog

object

(optional)

fluentdForward

object

(optional)

elasticsearch

object

(optional)

kafka

object

(optional)

cloudwatch

object

(optional)

loki

object

(optional)

googleCloudLogging

object

(optional)

splunk

object

(optional)

name

string

Name used to refer to the output from a pipeline.

secret

object

(optional) Secret for authentication.

tls

object

TLS contains settings for controlling options on TLS client connections.

type

string

Type of output plugin.

url

string

(optional) URL to send log records to.

name

string

Name of a secret in the namespace configured for log forwarder secrets.

insecureSkipVerify

bool

If InsecureSkipVerify is true, then the TLS client will be configured to ignore errors with certificates.

detectMultilineErrors

bool

(optional) DetectMultilineErrors enables multiline error detection of container logs

inputRefs

array

InputRefs lists the names (input.name) of inputs to this pipeline.

labels

object

(optional) Labels applied to log records passing through this pipeline.

name

string

(optional) Name is optional, but must be unique in the pipelines list if provided.

outputRefs

array

OutputRefs lists the names (output.name) of outputs from this pipeline.

parse

string

(optional) Parse enables parsing of log entries into structured logs

conditions

object

Conditions of the log forwarder.

inputs

Conditions

Inputs maps input name to condition of the input.

outputs

Conditions

Outputs maps output name to condition of the output.

pipelines

Conditions

Pipelines maps pipeline name to condition of the pipeline.

spec

object

Specification of the desired behavior of ClusterLogging

status

object

Status defines the observed state of ClusterLogging

collection

object

Specification of the Collection component for the cluster

curation

object

(DEPRECATED) (optional) Deprecated. Specification of the Curation component for the cluster

forwarder

object

(DEPRECATED) (optional) Deprecated. Specification for Forwarder component for the cluster

logStore

object

(optional) Specification of the Log Storage component for the cluster

managementState

string

(optional) Indicator if the resource is ‘Managed’ or ‘Unmanaged’ by the operator

visualization

object

(optional) Specification of the Visualization component for the cluster

resources

object

(optional) The resource requirements for the collector

nodeSelector

object

(optional) Define which Nodes the Pods are scheduled on.

tolerations

array

(optional) Define the tolerations the Pods will accept

fluentd

object

(optional) Fluentd represents the configuration for forwarders of type fluentd.

logs

object

(DEPRECATED) (optional) Deprecated. Specification of Log Collection for the cluster

type

string

(optional) The type of Log Collection to configure

buffer

object

inFile

object

chunkLimitSize

string

(optional) ChunkLimitSize represents the maximum size of each chunk. Events will be

flushInterval

string

(optional) FlushInterval represents the time duration to wait between two consecutive flush

flushMode

string

(optional) FlushMode represents the mode of the flushing thread to write chunks. The mode

flushThreadCount

int

(optional) FlushThreadCount reprents the number of threads used by the fluentd buffer

overflowAction

string

(optional) OverflowAction represents the action for the fluentd buffer plugin to

retryMaxInterval

string

(optional) RetryMaxInterval represents the maximum time interval for exponential backoff

retryTimeout

string

(optional) RetryTimeout represents the maximum time interval to attempt retries before giving up

retryType

string

(optional) RetryType represents the type of retrying flush operations. Flush operations can

retryWait

string

(optional) RetryWait represents the time duration between two consecutive retries to flush

totalLimitSize

string

(optional) TotalLimitSize represents the threshold of node space allowed per fluentd

readLinesLimit

int

(optional) ReadLinesLimit represents the number of lines to read with each I/O operation

fluentd

object

Specification of the Fluentd Log Collection component

type

string

The type of Log Collection to configure

nodeSelector

object

(optional) Define which Nodes the Pods are scheduled on.

resources

object

(optional) The resource requirements for the collector

tolerations

array

(optional) Define the tolerations the Pods will accept

limits

object

(optional) Limits describes the maximum amount of compute resources allowed.

requests

object

(optional) Requests describes the minimum amount of compute resources required.

effect

string

(optional) Effect indicates the taint effect to match. Empty means match all taint effects.

key

string

(optional) Key is the taint key that the toleration applies to. Empty means match all taint keys.

operator

string

(optional) Operator represents a key’s relationship to the value.

tolerationSeconds

int

(optional) TolerationSeconds represents the period of time the toleration (which must be

value

string

(optional) Value is the taint value the toleration matches to.

curator

object

The specification of curation to configure

type

string

The kind of curation to configure

nodeSelector

object

Define which Nodes the Pods are scheduled on.

resources

object

(optional) The resource requirements for Curator

schedule

string

The cron schedule that the Curator job is run. Defaults to “30 3 *”

tolerations

array

limits

object

(optional) Limits describes the maximum amount of compute resources allowed.

requests

object

(optional) Requests describes the minimum amount of compute resources required.

effect

string

(optional) Effect indicates the taint effect to match. Empty means match all taint effects.

key

string

(optional) Key is the taint key that the toleration applies to. Empty means match all taint keys.

operator

string

(optional) Operator represents a key’s relationship to the value.

tolerationSeconds

int

(optional) TolerationSeconds represents the period of time the toleration (which must be

value

string

(optional) Value is the taint value the toleration matches to.

fluentd

object

buffer

object

inFile

object

chunkLimitSize

string

(optional) ChunkLimitSize represents the maximum size of each chunk. Events will be

flushInterval

string

(optional) FlushInterval represents the time duration to wait between two consecutive flush

flushMode

string

(optional) FlushMode represents the mode of the flushing thread to write chunks. The mode

flushThreadCount

int

(optional) FlushThreadCount reprents the number of threads used by the fluentd buffer

overflowAction

string

(optional) OverflowAction represents the action for the fluentd buffer plugin to

retryMaxInterval

string

(optional) RetryMaxInterval represents the maximum time interval for exponential backoff

retryTimeout

string

(optional) RetryTimeout represents the maximum time interval to attempt retries before giving up

retryType

string

(optional) RetryType represents the type of retrying flush operations. Flush operations can

retryWait

string

(optional) RetryWait represents the time duration between two consecutive retries to flush

totalLimitSize

string

(optional) TotalLimitSize represents the threshold of node space allowed per fluentd

readLinesLimit

int

(optional) ReadLinesLimit represents the number of lines to read with each I/O operation

elasticsearch

object

Specification of the Elasticsearch Log Store component

lokistack

object

LokiStack contains information about which LokiStack to use for log storage if Type is set to LogStoreTypeLokiStack.

retentionPolicy

object

(optional) Retention policy defines the maximum age for an index after which it should be deleted

type

string

The Type of Log Storage to configure. The operator currently supports either using ElasticSearch

nodeCount

int

Number of nodes to deploy for Elasticsearch

nodeSelector

object

Define which Nodes the Pods are scheduled on.

proxy

object

Specification of the Elasticsearch Proxy component

redundancyPolicy

string

(optional)

resources

object

(optional) The resource requirements for Elasticsearch

storage

object

(optional) The storage specification for Elasticsearch data nodes

tolerations

array

resources

object

limits

object

(optional) Limits describes the maximum amount of compute resources allowed.

requests

object

(optional) Requests describes the minimum amount of compute resources required.

limits

object

(optional) Limits describes the maximum amount of compute resources allowed.

requests

object

(optional) Requests describes the minimum amount of compute resources required.

size

object

The max storage capacity for the node to provision.

storageClassName

string

(optional) The name of the storage class to use with creating the node’s PVC.

Format

string

Change Format at will. See the comment for Canonicalize for

d

object

d is the quantity in inf.Dec form if d.Dec != nil

i

int

i is the quantity in int64 scaled form, if d.Dec == nil

s

string

s is the generated value of this quantity to avoid recalculation

Dec

object

scale

int

unscaled

object

abs

Word

sign

neg

bool

scale

int

value

int

effect

string

(optional) Effect indicates the taint effect to match. Empty means match all taint effects.

key

string

(optional) Key is the taint key that the toleration applies to. Empty means match all taint keys.

operator

string

(optional) Operator represents a key’s relationship to the value.

tolerationSeconds

int

(optional) TolerationSeconds represents the period of time the toleration (which must be

value

string

(optional) Value is the taint value the toleration matches to.

name

string

Name of the LokiStack resource.

application

object

audit

object

infra

object

diskThresholdPercent

int

(optional) The threshold percentage of ES disk usage that when reached, old indices should be deleted (e.g. 75)

maxAge

string

(optional)

namespaceSpec

array

(optional) The per namespace specification to delete documents older than a given minimum age

pruneNamespacesInterval

string

(optional) How often to run a new prune-namespaces job

minAge

string

(optional) Delete the records matching the namespaces which are older than this MinAge (e.g. 1d)

namespace

string

Target Namespace to delete logs older than MinAge (defaults to 7d)

diskThresholdPercent

int

(optional) The threshold percentage of ES disk usage that when reached, old indices should be deleted (e.g. 75)

maxAge

string

(optional)

namespaceSpec

array

(optional) The per namespace specification to delete documents older than a given minimum age

pruneNamespacesInterval

string

(optional) How often to run a new prune-namespaces job

minAge

string

(optional) Delete the records matching the namespaces which are older than this MinAge (e.g. 1d)

namespace

string

Target Namespace to delete logs older than MinAge (defaults to 7d)

diskThresholdPercent

int

(optional) The threshold percentage of ES disk usage that when reached, old indices should be deleted (e.g. 75)

maxAge

string

(optional)

namespaceSpec

array

(optional) The per namespace specification to delete documents older than a given minimum age

pruneNamespacesInterval

string

(optional) How often to run a new prune-namespaces job

minAge

string

(optional) Delete the records matching the namespaces which are older than this MinAge (e.g. 1d)

namespace

string

Target Namespace to delete logs older than MinAge (defaults to 7d)

kibana

object

Specification of the Kibana Visualization component

type

string

The type of Visualization to configure

nodeSelector

object

Define which Nodes the Pods are scheduled on.

proxy

object

Specification of the Kibana Proxy component

replicas

int

Number of instances to deploy for a Kibana deployment

resources

object

(optional) The resource requirements for Kibana

tolerations

array

resources

object

limits

object

(optional) Limits describes the maximum amount of compute resources allowed.

requests

object

(optional) Requests describes the minimum amount of compute resources required.

limits

object

(optional) Limits describes the maximum amount of compute resources allowed.

requests

object

(optional) Requests describes the minimum amount of compute resources required.

effect

string

(optional) Effect indicates the taint effect to match. Empty means match all taint effects.

key

string

(optional) Key is the taint key that the toleration applies to. Empty means match all taint keys.

operator

string

(optional) Operator represents a key’s relationship to the value.

tolerationSeconds

int

(optional) TolerationSeconds represents the period of time the toleration (which must be

value

string

(optional) Value is the taint value the toleration matches to.

collection

object

(optional)

conditions

object

(optional)

curation

object

(optional)

logStore

object

(optional)

visualization

object

(optional)

logs

object

(optional)

fluentdStatus

object

(optional)

clusterCondition

object

(optional)

daemonSet

string

(optional)

nodes

object

(optional)

pods

string

(optional)

curatorStatus

array

(optional)

clusterCondition

object

(optional)

cronJobs

string

(optional)

schedules

string

(optional)

suspended

bool

(optional)

elasticsearchStatus

array

(optional)

cluster

object

(optional)

clusterConditions

object

(optional)

clusterHealth

string

(optional)

clusterName

string

(optional)

deployments

array

(optional)

nodeConditions

object

(optional)

nodeCount

int

(optional)

pods

object

(optional)

replicaSets

array

(optional)

shardAllocationEnabled

string

(optional)

statefulSets

array

(optional)

activePrimaryShards

int

The number of Active Primary Shards for the Elasticsearch Cluster

activeShards

int

The number of Active Shards for the Elasticsearch Cluster

initializingShards

int

The number of Initializing Shards for the Elasticsearch Cluster

numDataNodes

int

The number of Data Nodes for the Elasticsearch Cluster

numNodes

int

The number of Nodes for the Elasticsearch Cluster

pendingTasks

int

relocatingShards

int

The number of Relocating Shards for the Elasticsearch Cluster

status

string

The current Status of the Elasticsearch Cluster

unassignedShards

int

The number of Unassigned Shards for the Elasticsearch Cluster

kibanaStatus

array

(optional)

clusterCondition

object

(optional)

deployment

string

(optional)

pods

string

(optional) The status for each of the Kibana pods for the Visualization component

replicaSets

array

(optional)

replicas

int

(optional)