Log output types

Log outputs specified in the ClusterLogForwarder CR can be any of the following types:

default

The on-cluster, Red Hat managed log store. You are not required to configure the default output.

If you configure a default output, you receive an error message, because the default output name is reserved for referencing the on-cluster, Red Hat managed log store.

loki

Loki, a horizontally scalable, highly available, multi-tenant log aggregation system.

kafka

A Kafka broker. The kafka output can use a TCP or TLS connection.

elasticsearch

An external Elasticsearch instance. The elasticsearch output can use a TLS connection.

fluentdForward

An external log aggregation solution that supports Fluentd. This option uses the Fluentd forward protocols. The fluentForward output can use a TCP or TLS connection and supports shared-key authentication by providing a shared_key field in a secret. Shared-key authentication can be used with or without TLS.

The fluentdForward output is only supported if you are using the Fluentd collector. It is not supported if you are using the Vector collector. If you are using the Vector collector, you can forward logs to Fluentd by using the http output.

syslog

An external log aggregation solution that supports the syslog RFC3164 or RFC5424 protocols. The syslog output can use a UDP, TCP, or TLS connection.

cloudwatch

Amazon CloudWatch, a monitoring and log storage service hosted by Amazon Web Services (AWS).

Supported log data output types in OpenShift Logging 5.7

Red Hat OpenShift Logging 5.7 provides the following output types and protocols for sending log data to target log collectors.

Red Hat tests each of the combinations shown in the following table. However, you should be able to send log data to a wider range of target log collectors that ingest these protocols.

Table 1. Logging 5.7 outputs
OutputProtocolTested withFluentdVector

Cloudwatch

REST over HTTP(S)

Elasticsearch v6

v6.8.1

Elasticsearch v7

v7.12.2, 7.17.7

Elasticsearch v8

v8.4.3

Fluent Forward

Fluentd forward v1

Fluentd 1.14.6, Logstash 7.10.1

Google Cloud Logging

HTTP

HTTP 1.1

Fluentd 1.14.6, Vector 0.21

Kafka

Kafka 0.11

Kafka 2.4.1, 2.7.0, 3.3.1

Loki

REST over HTTP(S)

Loki 2.3.0, 2.7

Splunk

HEC

v8.2.9, 9.0.0

Syslog

RFC3164, RFC5424

Rsyslog 8.37.0-9.el7

Supported log data output types in OpenShift Logging 5.6

Red Hat OpenShift Logging 5.6 provides the following output types and protocols for sending log data to target log collectors.

Red Hat tests each of the combinations shown in the following table. However, you should be able to send log data to a wider range target log collectors that ingest these protocols.

Output typesProtocolsTested with

Amazon CloudWatch

REST over HTTPS

The current version of Amazon CloudWatch

elasticsearch

elasticsearch

Elasticsearch 6.8.23

Elasticsearch 7.10.1

Elasticsearch 8.6.1

fluentdForward

fluentd forward v1

fluentd 1.14.6

logstash 7.10.1

Loki

REST over HTTP and HTTPS

Loki 2.5.0 deployed on OCP

kafka

kafka 0.11

kafka 2.7.0

syslog

RFC-3164, RFC-5424

rsyslog-8.39.0

Fluentd doesn’t support Elasticsearch 8 as of 5.6.2. Vector doesn’t support fluentd/logstash/rsyslog before 5.7.0.

Supported log data output types in OpenShift Logging 5.5

Red Hat OpenShift Logging 5.5 provides the following output types and protocols for sending log data to target log collectors.

Red Hat tests each of the combinations shown in the following table. However, you should be able to send log data to a wider range target log collectors that ingest these protocols.

Output typesProtocolsTested with

Amazon CloudWatch

REST over HTTPS

The current version of Amazon CloudWatch

elasticsearch

elasticsearch

Elasticsearch 7.10.1

fluentdForward

fluentd forward v1

fluentd 1.14.6

logstash 7.10.1

Loki

REST over HTTP and HTTPS

Loki 2.5.0 deployed on OCP

kafka

kafka 0.11

kafka 2.7.0

syslog

RFC-3164, RFC-5424

rsyslog-8.39.0

Supported log data output types in OpenShift Logging 5.4

Red Hat OpenShift Logging 5.4 provides the following output types and protocols for sending log data to target log collectors.

Red Hat tests each of the combinations shown in the following table. However, you should be able to send log data to a wider range target log collectors that ingest these protocols.

Output typesProtocolsTested with

Amazon CloudWatch

REST over HTTPS

The current version of Amazon CloudWatch

elasticsearch

elasticsearch

Elasticsearch 7.10.1

fluentdForward

fluentd forward v1

fluentd 1.14.5

logstash 7.10.1

Loki

REST over HTTP and HTTPS

Loki 2.2.1 deployed on OCP

kafka

kafka 0.11

kafka 2.7.0

syslog

RFC-3164, RFC-5424

rsyslog-8.39.0

Supported log data output types in OpenShift Logging 5.3

Red Hat OpenShift Logging 5.3 provides the following output types and protocols for sending log data to target log collectors.

Red Hat tests each of the combinations shown in the following table. However, you should be able to send log data to a wider range target log collectors that ingest these protocols.

Output typesProtocolsTested with

Amazon CloudWatch

REST over HTTPS

The current version of Amazon CloudWatch

elasticsearch

elasticsearch

Elasticsearch 7.10.1

fluentdForward

fluentd forward v1

fluentd 1.7.4

logstash 7.10.1

Loki

REST over HTTP and HTTPS

Loki 2.2.1 deployed on OCP

kafka

kafka 0.11

kafka 2.7.0

syslog

RFC-3164, RFC-5424

rsyslog-8.39.0

Supported log data output types in OpenShift Logging 5.2

Red Hat OpenShift Logging 5.2 provides the following output types and protocols for sending log data to target log collectors.

Red Hat tests each of the combinations shown in the following table. However, you should be able to send log data to a wider range target log collectors that ingest these protocols.

Output typesProtocolsTested with

Amazon CloudWatch

REST over HTTPS

The current version of Amazon CloudWatch

elasticsearch

elasticsearch

Elasticsearch 6.8.1

Elasticsearch 6.8.4

Elasticsearch 7.12.2

fluentdForward

fluentd forward v1

fluentd 1.7.4

logstash 7.10.1

Loki

REST over HTTP and HTTPS

Loki 2.3.0 deployed on OCP and Grafana labs

kafka

kafka 0.11

kafka 2.4.1

kafka 2.7.0

syslog

RFC-3164, RFC-5424

rsyslog-8.39.0

Supported log data output types in OpenShift Logging 5.1

Red Hat OpenShift Logging 5.1 provides the following output types and protocols for sending log data to target log collectors.

Red Hat tests each of the combinations shown in the following table. However, you should be able to send log data to a wider range target log collectors that ingest these protocols.

Output typesProtocolsTested with

elasticsearch

elasticsearch

Elasticsearch 6.8.1

Elasticsearch 6.8.4

Elasticsearch 7.12.2

fluentdForward

fluentd forward v1

fluentd 1.7.4

logstash 7.10.1

kafka

kafka 0.11

kafka 2.4.1

kafka 2.7.0

syslog

RFC-3164, RFC-5424

rsyslog-8.39.0

Previously, the syslog output supported only RFC-3164. The current syslog output adds support for RFC-5424.