// Module included in the following assemblies:
//
// * observability/logging/cluster-logging-deploying.adoc

:_mod-docs-content-type: PROCEDURE
[id="create-cluster-logging-cli_{context}"]
= Creating a ClusterLogging object by using the CLI

This default {logging} configuration supports a wide array of environments. Review the topics on tuning and configuring components for information about modifications you can make.

.Prerequisites

* You have installed the {clo}.
* You have installed the {es-op} for your log store.
* You have installed the {oc-first}.

.Procedure

. Create a `ClusterLogging` object as a YAML file:
+
.Example `ClusterLogging` object
[source,yaml]
----
apiVersion: logging.openshift.io/v1
kind: ClusterLogging
metadata:
  name: instance <1>
  namespace: openshift-logging
spec:
  managementState: Managed <2>
  logStore:
    type: elasticsearch <3>
    retentionPolicy: <4>
      application:
        maxAge: 1d
      infra:
        maxAge: 7d
      audit:
        maxAge: 7d
    elasticsearch:
      nodeCount: 3 <5>
      storage:
        storageClassName: <storage_class_name> <6>
        size: 200G
      resources: <7>
          limits:
            memory: 16Gi
          requests:
            memory: 16Gi
      proxy: <8>
        resources:
          limits:
            memory: 256Mi
          requests:
            memory: 256Mi
      redundancyPolicy: SingleRedundancy
  visualization:
    type: kibana <9>
    kibana:
      replicas: 1
  collection:
    type: fluentd <10>
    fluentd: {}
----
<1> The name must be `instance`.
<2> The OpenShift Logging management state. In some cases, if you change the OpenShift Logging defaults, you must set this to `Unmanaged`.
However, an unmanaged deployment does not receive updates until OpenShift Logging is placed back into a managed state.
<3> Settings for configuring Elasticsearch. Using the CR, you can configure shard replication policy and persistent storage.
<4> Specify the length of time that Elasticsearch should retain each log source. Enter an integer and a time designation: weeks(w), hours(h/H), minutes(m) and seconds(s). For example, `7d` for seven days. Logs older than the `maxAge` are deleted. You must specify a retention policy for each log source or the Elasticsearch indices will not be created for that source.
<5> Specify the number of Elasticsearch nodes. See the note that follows this list.
<6> Enter the name of an existing storage class for Elasticsearch storage. For best performance, specify a storage class that allocates block storage. If you do not specify a storage class, OpenShift Logging uses ephemeral storage.
<7> Specify the CPU and memory requests for Elasticsearch as needed. If you leave these values blank, the OpenShift Elasticsearch Operator sets default values that should be sufficient for most deployments. The default values are `16Gi` for the memory request and `1` for the CPU request.
<8> Specify the CPU and memory requests for the Elasticsearch proxy as needed. If you leave these values blank, the OpenShift Elasticsearch Operator sets default values that should be sufficient for most deployments. The default values are `256Mi` for the memory request and `100m` for the CPU request.
<9> Settings for configuring Kibana. Using the CR, you can scale Kibana for redundancy and configure the CPU and memory for your Kibana nodes. For more information, see *Configuring the log visualizer*.
<10> Settings for configuring Fluentd. Using the CR, you can configure Fluentd CPU and memory limits. For more information, see "Configuring Fluentd".
+
[NOTE]
+
====
The maximum number of Elasticsearch control plane nodes is three. If you specify a `nodeCount` greater than `3`, {product-title} creates three Elasticsearch nodes that are Master-eligible nodes, with the master, client, and data roles. The additional Elasticsearch nodes are created as data-only nodes, using client and data roles. Control plane nodes perform cluster-wide actions such as creating or deleting an index, shard allocation, and tracking nodes. Data nodes hold the shards and perform data-related operations such as CRUD, search, and aggregations. Data-related operations are I/O-, memory-, and CPU-intensive. It is important to monitor these resources and to add more Data nodes if the current nodes are overloaded.

For example, if `nodeCount=4`, the following nodes are created:

[source,terminal]
----
$ oc get deployment
----

.Example output
[source,terminal]
----
NAME                           READY   UP-TO-DATE   AVAILABLE   AGE
cluster-logging-operator       1/1     1            1           18h
elasticsearch-cd-x6kdekli-1    1/1     1            1          6m54s
elasticsearch-cdm-x6kdekli-1   1/1     1            1           18h
elasticsearch-cdm-x6kdekli-2   1/1     1            1           6m49s
elasticsearch-cdm-x6kdekli-3   1/1     1            1           6m44s
----

The number of primary shards for the index templates is equal to the number of Elasticsearch data nodes.
====

.Verification

You can verify the installation by listing the pods in the `openshift-logging` project.

* List the pods by running the following command:
+
[source,terminal]
----
$ oc get pods -n openshift-logging
----
+
Observe the pods for components of the {logging}, similar to the following list:
+
.Example output
[source,terminal]
----
NAME                                            READY   STATUS    RESTARTS   AGE
cluster-logging-operator-66f77ffccb-ppzbg       1/1     Running   0          7m
elasticsearch-cdm-ftuhduuw-1-ffc4b9566-q6bhp    2/2     Running   0          2m40s
elasticsearch-cdm-ftuhduuw-2-7b4994dbfc-rd2gc   2/2     Running   0          2m36s
elasticsearch-cdm-ftuhduuw-3-84b5ff7ff8-gqnm2   2/2     Running   0          2m4s
collector-587vb                                   1/1     Running   0          2m26s
collector-7mpb9                                   1/1     Running   0          2m30s
collector-flm6j                                   1/1     Running   0          2m33s
collector-gn4rn                                   1/1     Running   0          2m26s
collector-nlgb6                                   1/1     Running   0          2m30s
collector-snpkt                                   1/1     Running   0          2m28s
kibana-d6d5668c5-rppqm                          2/2     Running   0          2m39s
----
