// Module included in the following assemblies:
//
// * observability/logging/log_collection_forwarding/log-forwarding.adoc

:_mod-docs-content-type: REFERENCE
[id="logging-create-clf_{context}"]
= Creating a log forwarder

To create a log forwarder, you must create a `ClusterLogForwarder` CR that specifies the log input types that the service account can collect. You can also specify which outputs the logs can be forwarded to. If you are using the multi log forwarder feature, you must also reference the service account in the `ClusterLogForwarder` CR.

If you are using the multi log forwarder feature on your cluster, you can create `ClusterLogForwarder` custom resources (CRs) in any namespace, using any name.
If you are using a legacy implementation, the `ClusterLogForwarder` CR must be named `instance`, and must be created in the `openshift-logging` namespace.

[IMPORTANT]
====
You need administrator permissions for the namespace where you create the `ClusterLogForwarder` CR.
====

.ClusterLogForwarder resource example
[source,yaml]
----
apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: <log_forwarder_name> <1>
  namespace: <log_forwarder_namespace> <2>
spec:
  serviceAccountName: <service_account_name> <3>
  pipelines:
   - inputRefs:
     - <log_type> <4>
     outputRefs:
     - <output_name> <5>
  outputs:
  - name: <output_name> <6>
    type: <output_type> <5>
    url: <log_output_url> <7>
# ...
----
<1> In legacy implementations, the CR name must be `instance`. In multi log forwarder implementations, you can use any name.
<2> In legacy implementations, the CR namespace must be `openshift-logging`. In multi log forwarder implementations, you can use any namespace.
<3> The name of your service account. The service account is only required in multi log forwarder implementations if the log forwarder is not deployed in the `openshift-logging` namespace.
<4> The log types that are collected. The value for this field can be `audit` for audit logs, `application` for application logs, `infrastructure` for infrastructure logs, or a named input that has been defined for your application.
<5> The type of output that you want to forward logs to. The value of this field can be `default`, `loki`, `kafka`, `elasticsearch`, `fluentdForward`, `syslog`, or `cloudwatch`.
+
[NOTE]
====
The `default` output type is not supported in mutli log forwarder implementations.
====
<6> A name for the output that you want to forward logs to.
<7> The URL of the output that you want to forward logs to.

// To be followed up on by adding input examples / docs:
////
spec:
  inputs:
  - name: chatty-app
    type: application
    selector:
        matchLabels:
          load: heavy
  pipelines:
  - inputRefs:
    - chatty-app
    - infrastructure
  - outputRefs:
    - default
////
