openshift/origin-aggregated-logging

Customizing index_name when using multiple Clusters sharing same ELK instance

uselessidbr opened this issue · 1 comments

I'm running two OKD's 3.11 clusters and our company decided to externalize the logs to an external EFK stack. We're still using FLUENTD internally.

The problem is, i couldn't find how to customize the indices's names so we can differentiate the logs from both OKD's clusters.

It seems that the "operations" and "project" indices are somehow "hardcoded".

AFAIK it's being handled by VIAQ plugin and i couldn't find any way to surpass this.

Sadly i don't know much about how EFK stack setup works.

Hope someone can elucidate it.

Thanks in advance!

The names are intentionally opinionated and it is not possible to configure them without modifying the fluent config yourself