Giters

openshift / cluster-logging-operator

Operator to support logging subsystem of OpenShift

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Feature Request: configure splunk-hec via ClusterLogForwarder

toastbrotch opened this issue · comments

commented

i've found quite a bunch of documentations where logforwarding to splunk is done via additional fluentd but none how to do this directly. as far as i see the fluend image already contains fluent-plugin-splunk-hec so i request a possiblity to configure it directly via cluster-logging-operator for simplicity and stability. maybe its already possible, but i could not find it. thanx

commented

Hi @toastbrotch. Thanks for reaching out. Have you ever thought about using Splunk Connect for Kubernetes to forward logs to Splunk? It is a component provided and supported by Splunk themselves. We usually encourage everyone to do that instead of using OpenShift Logging. We still think about adding something in the future to cover cases where you send messages to multiple different third party systems, but it's a very low priority for us compared to other things on our backlog.

commented

i've gone the route/hack with another fluentd where i'm able to configure HEC. I don't want thirdparty privileged pods all around the cluster, so "Splunk Connect for Kubernetes" is no option. i'd still prefer a real solution as proposed...

docs i used:
https://www.openshift.com/blog/forwarding-logs-to-splunk-using-the-openshift-log-forwarding-api
https://github.com/sabre1041/openshift-logforwarding-splunk

commented

Hi, I need this feature too