Feature Request: configure splunk-hec via ClusterLogForwarder
toastbrotch opened this issue · comments
i've found quite a bunch of documentations where logforwarding to splunk is done via additional fluentd but none how to do this directly. as far as i see the fluend image already contains fluent-plugin-splunk-hec so i request a possiblity to configure it directly via cluster-logging-operator for simplicity and stability. maybe its already possible, but i could not find it. thanx
Hi @toastbrotch. Thanks for reaching out. Have you ever thought about using Splunk Connect for Kubernetes to forward logs to Splunk? It is a component provided and supported by Splunk themselves. We usually encourage everyone to do that instead of using OpenShift Logging. We still think about adding something in the future to cover cases where you send messages to multiple different third party systems, but it's a very low priority for us compared to other things on our backlog.
i've gone the route/hack with another fluentd where i'm able to configure HEC. I don't want thirdparty privileged pods all around the cluster, so "Splunk Connect for Kubernetes" is no option. i'd still prefer a real solution as proposed...
docs i used:
https://www.openshift.com/blog/forwarding-logs-to-splunk-using-the-openshift-log-forwarding-api
https://github.com/sabre1041/openshift-logforwarding-splunk
Hi, I need this feature too
Closing in favor of https://issues.redhat.com/browse/LOG-1095