How to configure the clusterLogForwarder to log forward to the Red Hat Managed Elasticsearch in Red Hat OpenShift Logging 6
Issue
- How can the collector be configured to continue log forwarding to the Red Hat Managed Elasticsearch after migrating to Red Hat OpenShift Logging (RHOL) 6?
-
After migrating to Logging 6 and configured to continue sending to the Red Hat Managed Elasticsearch following the example from the Documentation section "Red Hat Managed Elasticsearch" , the Elasticsearch is not receiving any logs and the collectors show errors like:
2025-01-27T17:36:00.944148Z ERROR sink{component_kind="sink" component_id=output_default_elasticsearch component_type=elasticsearch}: vector::sinks::elasticsearch::service: Response contained errors. error_code="http_response_200" response=Response { status: 200, version: HTTP/1.1, headers: {"content-length": "2138", "content-type": "application/json; charset=UTF-8", "gap-upstream-address": "localhost:9200", "date": "Mon, 27 Jan 2025 17:36:00 GMT"}, body: b"{\"took\":0,\"ingest_took\":0,\"errors\":true,\"items\":[{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"MDlkZTE4YTEtNGRkZS00NTg1LWFiNjEtNTNmZjU2ODBmNDY1\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}},{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"ZGM1YjY2NTEtZjcwOC00NTYzLThiMDktOGY3OGZhNTY1MjMx\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}},{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"OWNkZDk3MTEtNWQyYS00NDA3LWEyYzAtMmY5NzQzODRiYWMz\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}},{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"Y2U0NDY4Y2EtMzM0Yy00MjQ4LWFmZWMtYTRkN2NlYWMwOGI0\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}},{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"MzkzNjg4NmEtYWM1MS00ZjNmLWJlMWYtYTAyMWM0ZmJjMThm\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}},{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"ZmJiODQxZjYtYWE3OS00MGU3LTk5YjgtOWU0ODZiMjM3NmZl\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}}]}" }
Environment
- Red Hat OpenShift Container Platform (RHOCP)
- 4
- Red Hat OpenShift Logging (RHOL)
- 6
- Vector
- Elasticsearch
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.