Support Elasticsearch 8 as an output in RHOCP 4
Issue
- Needed to send logs to Elasticsearch 8
- Not able to send logs from OCP Logging stack to Elasticsearch 8
-
Failing to deliver logs to Elasticsearch 8 with the error
contains an unknown parameter [_type]
$ oc logs <collector> -n openshift-logging 2022-04-25 06:24:05 +0000 [warn]: [elasticsearch8] failed to flush the buffer. retry_time=36 next_retry_seconds=2022-04-25 06:25:02 +0000 chunk="5dd7459d6d36c1e0875d29c091e3947f" error_class=Fluent::Plugin::ElasticsearchOutput::RecoverableRequestFailure error="could not push logs to Elasticsearch cluster ({:host=>\"elasticsearch8.example.com\", :port=>9200, :scheme=>\"https\", :user=>\"user\", :password=>\"obfuscated\"}): [400] {\"error\":{\"root_cause\":[{\"type\":\"illegal_argument_exception\",\"reason\":\"Action/metadata line [1] contains an unknown parameter [_type]\"}],\"type\":\"illegal_argument_exception\",\"reason\":\"Action/metadata line [1] contains an unknown parameter [_type]\"},\"status\":400}"
Environment
- Red Hat OpenShift Container Platform (RHOCP)
- Red Hat OpenShift Logging (RHOL)
- 5
- Elasticsearch 8
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.