JSON logs are not parsed for the external Elasticsearch in RHOCP 4

Solution Verified - Updated -

Issue

  • Application logs with a JSON structure are not sent.
  • After adding parse: json field in the ClusterLogForwarder (CLF) instance, the JSON logs are not sent.
  • After creating a ClusterLogForwarder (CLF) instance with the external Elasticsearch output and JSON enabled, the message below appears in the instance:

    $ oc get clf instance -o yaml
    [...]
    status:
    conditions:
    - lastTransitionTime: "2023-04-03T08:41:15Z"
    message: 'validation failed: structuredTypeKey or structuredTypeName must be defined
      for Elasticsearch output named "elasticsearch-test" when JSON parsing is enabled
      on pipeline "my-app" that references it'
    reason: Invalid
    status: "False"
    type: Ready
    [...]
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4
  • Red Hat Openshift Logging (RHOL)
    • 5.6

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content