From 82aee9439db63cf7cee371d595b3ee3a810d2287 Mon Sep 17 00:00:00 2001
From: Prithviraj Patil <116709298+prithvipatil97@users.noreply.github.com>
Date: Tue, 11 Mar 2025 03:24:22 +0530
Subject: [PATCH] v6.0 Forwarding to Red Hat Managed Elasticsearch is broken

- v6.0 Forwarding to Red Hat Managed Elasticsearch is broken
- Here is the documentation link:
  https://docs.openshift.com/container-platform/4.16/observability/logging/logging-6.0/log6x-upgrading-to-6.html#red-hat-managed-elasticsearch

- Here entire example for `v6.0 Forwarding to Red Hat Managed Elasticsearch` is wrongly mentioned.
- For correct format kindly refer to KCS: https://access.redhat.com/solutions/7105074

- We need to correct this configuration in the documentation as well.
- Here is the updated `ClusterLogForwarder` configuration:

~~~
apiVersion: observability.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: collector
  namespace: openshift-logging
spec:
  serviceAccount:
    name: <service_account_name>
  managementState: Managed
  outputs:
  - name: audit-elasticsearch
    type: elasticsearch
    elasticsearch:
      url: https://elasticsearch:9200
      version: 6
      index: audit-write
    tls:
      ca:
        key: ca-bundle.crt
        secretName: collector
      certificate:
        key: tls.crt
        secretName: collector
      key:
        key: tls.key
        secretName: collector
  - name: app-elasticsearch
    type: elasticsearch
    elasticsearch:
      url: https://elasticsearch:9200
      version: 6
      index: app-write
    tls:
      ca:
        key: ca-bundle.crt
        secretName: collector
      certificate:
        key: tls.crt
        secretName: collector
      key:
        key: tls.key
        secretName: collector
  - name: infra-elasticsearch
    type: elasticsearch
    elasticsearch:
      url: https://elasticsearch:9200
      version: 6
      index: infra-write
    tls:
      ca:
        key: ca-bundle.crt
        secretName: collector
      certificate:
        key: tls.crt
        secretName: collector
      key:
        key: tls.key
        secretName: collector
  pipelines:
  - name: app
    inputRefs:
    - application
    outputRefs:
    - app-elasticsearch
  - name: audit
    inputRefs:
    - audit
    outputRefs:
    - audit-elasticsearch
  - name: infra
    inputRefs:
    - infrastructure
    outputRefs:
    - infra-elasticsearch
~~~
---
 .../logging-6.0/log6x-upgrading-to-6.adoc     | 60 +++++++++++++++----
 1 file changed, 50 insertions(+), 10 deletions(-)

diff --git a/observability/logging/logging-6.0/log6x-upgrading-to-6.adoc b/observability/logging/logging-6.0/log6x-upgrading-to-6.adoc
index 601f4df178..ab53e78a8f 100644
--- a/observability/logging/logging-6.0/log6x-upgrading-to-6.adoc
+++ b/observability/logging/logging-6.0/log6x-upgrading-to-6.adoc
@@ -251,13 +251,48 @@ metadata:
   name: instance
   namespace: openshift-logging
 spec:
+  serviceAccount:
+    name: <service_account_name>
+  managementState: Managed
   outputs:
-  - name: default-elasticsearch
+  - name: audit-elasticsearch
     type: elasticsearch
     elasticsearch:
       url: https://elasticsearch:9200
       version: 6
-      index: <log_type>-write-{+yyyy.MM.dd}
+      index: audit-write
+    tls:
+      ca:
+        key: ca-bundle.crt
+        secretName: collector
+      certificate:
+        key: tls.crt
+        secretName: collector
+      key:
+        key: tls.key
+        secretName: collector
+  - name: app-elasticsearch
+    type: elasticsearch
+    elasticsearch:
+      url: https://elasticsearch:9200
+      version: 6
+      index: app-write
+    tls:
+      ca:
+        key: ca-bundle.crt
+        secretName: collector
+      certificate:
+        key: tls.crt
+        secretName: collector
+      key:
+        key: tls.key
+        secretName: collector
+  - name: infra-elasticsearch
+    type: elasticsearch
+    elasticsearch:
+      url: https://elasticsearch:9200
+      version: 6
+      index: infra-write
     tls:
       ca:
         key: ca-bundle.crt
@@ -269,18 +304,23 @@ spec:
         key: tls.key
         secretName: collector
   pipelines:
-  - outputRefs:
-    - default-elasticsearch
-  - inputRefs:
+  - name: app
+    inputRefs:
     - application
+    outputRefs:
+    - app-elasticsearch
+  - name: audit
+    inputRefs:
+    - audit
+    outputRefs:
+    - audit-elasticsearch
+  - name: infra
+    inputRefs:
     - infrastructure
+    outputRefs:
+    - infra-elasticsearch
 ----
 
-[NOTE]
-====
-In this example, application logs are written to the `application-write` alias/index instead of `app-write`.
-====
-
 == Red Hat Managed LokiStack
 
 .v5.9 Forwarding to Red Hat Managed LokiStack