How to configure the clusterLogForwarder to log forward to the Red Hat Managed Elasticsearch in Red Hat OpenShift Logging 6

Solution Verified - Updated -

Issue

  • How can the collector be configured to continue log forwarding to the Red Hat Managed Elasticsearch after migrating to Red Hat OpenShift Logging (RHOL) 6?
  • After migrating to Logging 6 and configured to continue sending to the Red Hat Managed Elasticsearch following the example from the Documentation section "Red Hat Managed Elasticsearch" , the Elasticsearch is not receiving any logs and the collectors show errors like:

    2025-01-27T17:36:00.944148Z ERROR sink{component_kind="sink" component_id=output_default_elasticsearch component_type=elasticsearch}: vector::sinks::elasticsearch::service: Response contained errors. error_code="http_response_200" response=Response { status: 200, version: HTTP/1.1, headers: {"content-length": "2138", "content-type": "application/json; charset=UTF-8", "gap-upstream-address": "localhost:9200", "date": "Mon, 27 Jan 2025 17:36:00 GMT"}, body: b"{\"took\":0,\"ingest_took\":0,\"errors\":true,\"items\":[{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"MDlkZTE4YTEtNGRkZS00NTg1LWFiNjEtNTNmZjU2ODBmNDY1\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}},{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"ZGM1YjY2NTEtZjcwOC00NTYzLThiMDktOGY3OGZhNTY1MjMx\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}},{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"OWNkZDk3MTEtNWQyYS00NDA3LWEyYzAtMmY5NzQzODRiYWMz\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}},{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"Y2U0NDY4Y2EtMzM0Yy00MjQ4LWFmZWMtYTRkN2NlYWMwOGI0\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}},{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"MzkzNjg4NmEtYWM1MS00ZjNmLWJlMWYtYTAyMWM0ZmJjMThm\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}},{\"create\":{\"_index\":\"infrastructure-write\",\"_type\":\"_doc\",\"_id\":\"ZmJiODQxZjYtYWE3OS00MGU3LTk5YjgtOWU0ODZiMjM3NmZl\",\"status\":404,\"error\":{\"type\":\"index_not_found_exception\",\"reason\":\"no such index and [action.auto_create_index] contains [-*-write] which forbids automatic creation of the index\",\"index_uuid\":\"_na_\",\"index\":\"infrastructure-write\"}}}]}" }
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4
  • Red Hat OpenShift Logging (RHOL)
    • 6
  • Vector
  • Elasticsearch

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content