Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 1. Logging 6.3 release notes

1.1. Logging 6.3.1 release notes
Copy link

This release includes RHBA-2025:16105.

1.1.1. Bug fixes
Copy link

  • Before this update, the log collector was configured to find the event timestamp at the root of the log record. When forwarding logs to Splunk with a payloadKey value specified, the timestamp field was omitted causing timestamp-related warnings. As a consequence, timestamp warnings flooded collector pods, disrupting log forwarding to Splunk. With this update, the log collector uses an internal timestamp field when forwarding logs. This ensures that the correct timestamp is used when forwarding logs to Splunk, resolving the issue. (LOG-7311)
  • Before this update, using the prune filter to remove Kubernetes metadata fields such as .kubernetes.namespace_name caused a remapping error during Syslog output generation. This prevented the appname and tag fields from being correctly initialized and could prevent forwarding of logs. With this update, this issue is fixed. Improved error handling initializes these fields with an empty string if the source metadata is missing, ensuring successful log processing. (LOG-7355)
  • Before this update, a log record with a malformed timestamp could cause the Vector agent to panic when attempting to forward logs to Loki. With this update, error handling for out-of-range timestamp values has been improved resolving the issue. (LOG-7417)
  • Before this update, the loki-gateway did not apply the OR expression for openshift-network tenants in LokiStack. With this update, the loki-gateway correctly applies the OR expression for the openshift-network tenants in LokiStack. (LOG-7421)
  • Before this update, the vector_buffer_byte_size and vector_buffer_events metrics incorrectly reported negative values under certain system load and timing conditions. This led to unreliable monitoring, potentially masking buffer issues. With this update, a concurrent, centralized state tracker ensures that these metrics are always reported as non-negative values. This ensures that the metrics correctly report buffer sizes helping with accurate monitoring.(LOG-7592)
  • Before this update, a change to the container image format caused issues when mirroring the images to image registries that do not support the new format. With this update, the container images are published using the older format again resolving the issue. (LOG-7699)

1.2. Logging 6.3.0 release notes
Copy link

This release of OpenShift Logging is supported on OpenShift Container Platform 4.17 and later. This release includes RHBA-2025:11336.

1.2.1. New features and enhancements
Copy link

1.2.1.1. Log collection
Copy link

  • With this release, you can configure multiple Amazon Web Services (AWS) outputs with distinct identity and access management (IAM) roles in the clusterLogForwarder resource. (LOG-6790)
  • With this release, you can configure affinity rules to control collector scheduling. (LOG-6858)
  • With this release, the default values of Splunk metadata keys (that is, index, indexed fields, source, and message payload) are predefined for log forwarders. The values are based on the log type. As a user, you can override these values. (LOG-6859)

1.2.1.2. Log storage
Copy link

  • With this release, you can use the forcepathstyle field in the S3 secret. Use this field to configure Loki to use either path style or virtual host style for the S3 access. By default, only AWS endpoints use the virtual host style URL, while others use path-style. (LOG-7024)

1.2.2. Technology preview features
Copy link

Important

The OpenTelemetry Protocol (OTLP) output log forwarder is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

1.2.3. Bug fixes
Copy link

  • Before this update, collector pods would enter a crash loop due to a configuration error when attempting token-based authentication with an Elasticsearch output. With this update, token authentication with an Elasticsearch output generates a valid configuration. (LOG-5991)
  • Before this update, because of a lack of filtering based on the namespace in the Prometheus rules endpoint, user alerts were visible in unrelated namespaces. With this update, rule label filters have been added to the handler configuration. As a result, alert visibility is now restricted to the original namespace. (LOG-6148)
  • Before this update, the Loki API documentation did not specify the required attributes for the lokistack.spec.tenants.openshift.otlp resource. With this update, the Loki API documentation has been updated to include the missing information. (LOG-6810)
  • Before this update, the loki-gateway did not enforce fine-grained authorization on the /series endpoint for the application tenant. As a consequence, users could get unauthorized access to the stream metadata information from different log streams. With this update, the /series endpoint uses the match parameter instead of the query parameter to filter the series metadata that is returned for a request. As a result, the loki-gateway correctly enforces fine-grained authorization for the /series endpoint for the application tenant. (LOG-6892)

  • Before this update, restarting Vector collector pods in OpenShift Container Platform clusters created a high volume of requests to the KubeAPI. As a result, the control plane could become unavailable. With this update, when restarting the collector pods, users can enable kube caching with the use-apiserver-cache attribute and configure the DaemonSet rollout strategy with the max-unavailable-rollout attribute . As a result, the control plane remains stable during collector pod restarts, which reduces API request timeouts. (LOG-7196)

    Important

    Using the use-apiserver-cache and max-unavailable-rollout attributes is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

    For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

  • Before this update, a ClusterLogForwarder CR that was configured for a LokiStack output with the OTEL data model incorrectly passed validation without the tech preview annotation. With this update, a ClusterLogForwarder CR that is configured for a LokiStack output with the OTEL data model correctly fails validation unless the tech preview annotation is included. (LOG-7279)

1.2.4. Known issues
Copy link

  • When you forward logs to a syslog output, the produced message format is inconsistent between Fluentd and Vector log collectors. Vector messages are within quotation marks; Fluentd messages are not. As a consequence, users might experience issues with their tool integrations when they migrate from Fluentd to Vector. (LOG-7007)
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat