The Logging custom resource
The logging
resource defines the logging infrastructure for your cluster that collects and transports your log messages, and also contains configurations for the Fluent Bit log collector and the Fluentd and syslog-ng log forwarders. It also establishes the controlNamespace
, the administrative namespace of the Logging operator. The Fluentd and syslog-ng statefulsets and the Fluent Bit daemonset are deployed in this namespace, and global resources like ClusterOutput
and ClusterFlow
are evaluated only in this namespace by default - they are ignored in any other namespace unless allowClusterResourcesFromAllNamespaces
is set to true.
You can customize the configuration of Fluentd, syslog-ng, and Fluent Bit in the logging resource. The logging resource also declares watchNamespaces
, that specifies the namespaces where Flow
/SyslogNGFlow
and Output
/SyslogNGOutput
resources will be applied into Fluentd’s/syslog-ng’s configuration.
Note: By default, the Logging operator Helm chart doesn’t install the
logging
resource. If you want to install it with Helm, set thelogging.enabled
value to true.For details on customizing the installation, see the Helm chart values.
You can customize the following sections of the logging resource:
- Generic parameters of the logging resource. For the list of available parameters, see LoggingSpec.
- The
fluentd
statefulset that Logging operator deploys. For a list of parameters, see FluentdSpec. For examples on customizing the Fluentd configuration, see Configure Fluentd. - The
syslogNG
statefulset that Logging operator deploys. For a list of parameters, see SyslogNGSpec. For examples on customizing the Fluentd configuration, see Configure syslog-ng. - The
fluentbit
field is deprecated. Fluent Bit should now be configured separately, see Fluent Bit log collector.
The following example snippets use the logging namespace. To create this namespace if it does not already exist, run:
A simple logging
example
Filter namespaces
In the following example, the watchNamespaces option is set, so logs are collected only from the prod and test namespaces.
Starting with Logging operator version 4.3, you can use the watchNamespaceSelector
selector to select the watched namespaces based on their label, or an expression, for example:
If both watchNamespaces
and watchNamespaceSelector
are set, the union of them will take effect.