Chapter 4. Quick start

Procedure

1. Install the Red Hat OpenShift Logging Operator, Loki Operator, and Cluster Observability Operator (COO) from OperatorHub.

2. Create a LokiStack custom resource (CR) in the openshift-logging namespace:

   apiVersion: loki.grafana.com/v1
   kind: LokiStack
   metadata:
     name: logging-loki
     namespace: openshift-logging
   spec:
     managementState: Managed
     size: 1x.extra-small
     storage:
       schemas:
       - effectiveDate: '2024-10-01'
         version: v13
       secret:
         name: logging-loki-s3
         type: s3
     storageClassName: gp3-csi
     tenants:
       mode: openshift-logging

   Copy to Clipboard Toggle word wrap
   Note

   Ensure that the logging-loki-s3 secret is created beforehand. The contents of this secret vary depending on the object storage in use. For more information, see Secrets and TLS Configuration.

3. Create a service account for the collector:

   $ oc create sa collector -n openshift-logging

   Copy to Clipboard Toggle word wrap

4. Allow the collector’s service account to write data to the LokiStack CR:

   $ oc adm policy add-cluster-role-to-user logging-collector-logs-writer -z collector -n openshift-logging

   Copy to Clipboard Toggle word wrap
   Note

   The ClusterRole resource is created automatically during the Cluster Logging Operator installation and does not need to be created manually.

5. To collect logs, use the service account of the collector by running the following commands:

   $ oc adm policy add-cluster-role-to-user collect-application-logs -z collector -n openshift-logging

   Copy to Clipboard Toggle word wrap

   $ oc adm policy add-cluster-role-to-user collect-audit-logs -z collector -n openshift-logging

   Copy to Clipboard Toggle word wrap

   $ oc adm policy add-cluster-role-to-user collect-infrastructure-logs -z collector -n openshift-logging

   Copy to Clipboard Toggle word wrap
   Note

   The example binds the collector to all three roles (application, infrastructure, and audit), but by default, only application and infrastructure logs are collected. To collect audit logs, update your ClusterLogForwarder configuration to include them. Assign roles based on the specific log types required for your environment.

6. Create a UIPlugin CR to enable the Log section in the Observe tab:

   apiVersion: observability.openshift.io/v1alpha1
   kind: UIPlugin
   metadata:
     name: logging
   spec:
     type: Logging
     logging:
       lokiStack:
         name: logging-loki

   Copy to Clipboard Toggle word wrap

7. Create a ClusterLogForwarder CR to configure log forwarding:

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: collector
     namespace: openshift-logging
   spec:
     serviceAccount:
       name: collector
     outputs:
     - name: default-lokistack
       type: lokiStack
       lokiStack:
         authentication:
           token:
             from: serviceAccount
         target:
           name: logging-loki
           namespace: openshift-logging
       tls:
         ca:
           key: service-ca.crt
           configMapName: openshift-service-ca.crt
     pipelines:
     - name: default-logstore
       inputRefs:
       - application
       - infrastructure
       outputRefs:
       - default-lokistack

   Copy to Clipboard Toggle word wrap
   Note

   The dataModel field is optional and left unset (dataModel: "") by default. This allows the Cluster Logging Operator (CLO) to automatically select a data model. Currently, the CLO defaults to the ViaQ model when the field is unset, but this will change in future releases. Specifying dataModel: ViaQ ensures the configuration remains compatible if the default changes.

Procedure

1. Install the Red Hat OpenShift Logging Operator, Loki Operator, and Cluster Observability Operator (COO) from OperatorHub.

2. Create a LokiStack custom resource (CR) in the openshift-logging namespace:

   apiVersion: loki.grafana.com/v1
   kind: LokiStack
   metadata:
     name: logging-loki
     namespace: openshift-logging
   spec:
     managementState: Managed
     size: 1x.extra-small
     storage:
       schemas:
       - effectiveDate: '2024-10-01'
         version: v13
       secret:
         name: logging-loki-s3
         type: s3
     storageClassName: gp3-csi
     tenants:
       mode: openshift-logging

   Copy to Clipboard Toggle word wrap
   Note

   Ensure that the logging-loki-s3 secret is created beforehand. The contents of this secret vary depending on the object storage in use. For more information, see "Secrets and TLS Configuration".

3. Create a service account for the collector:

   $ oc create sa collector -n openshift-logging

   Copy to Clipboard Toggle word wrap

4. Allow the collector’s service account to write data to the LokiStack CR:

   $ oc adm policy add-cluster-role-to-user logging-collector-logs-writer -z collector

   Copy to Clipboard Toggle word wrap
   Note

   The ClusterRole resource is created automatically during the Cluster Logging Operator installation and does not need to be created manually.

5. Allow the collector’s service account to collect logs:

   $ oc project openshift-logging

   Copy to Clipboard Toggle word wrap

   $ oc adm policy add-cluster-role-to-user collect-application-logs -z collector

   Copy to Clipboard Toggle word wrap

   $ oc adm policy add-cluster-role-to-user collect-audit-logs -z collector

   Copy to Clipboard Toggle word wrap

   $ oc adm policy add-cluster-role-to-user collect-infrastructure-logs -z collector

   Copy to Clipboard Toggle word wrap
   Note

   The example binds the collector to all three roles (application, infrastructure, and audit). By default, only application and infrastructure logs are collected. To collect audit logs, update your ClusterLogForwarder configuration to include them. Assign roles based on the specific log types required for your environment.

6. Create a UIPlugin CR to enable the Log section in the Observe tab:

   apiVersion: observability.openshift.io/v1alpha1
   kind: UIPlugin
   metadata:
     name: logging
   spec:
     type: Logging
     logging:
       lokiStack:
         name: logging-loki

   Copy to Clipboard Toggle word wrap

7. Create a ClusterLogForwarder CR to configure log forwarding:

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: collector
     namespace: openshift-logging
     annotations:
       observability.openshift.io/tech-preview-otlp-output: "enabled" 

   1

   
   spec:
     serviceAccount:
       name: collector
     outputs:
     - name: loki-otlp
       type: lokiStack 

   2

   
       lokiStack:
         target:
           name: logging-loki
           namespace: openshift-logging
         dataModel: Otel 

   3

   
         authentication:
           token:
             from: serviceAccount
       tls:
         ca:
           key: service-ca.crt
           configMapName: openshift-service-ca.crt
     pipelines:
     - name: my-pipeline
       inputRefs:
       - application
       - infrastructure
       outputRefs:
       - loki-otlp

   Copy to Clipboard Toggle word wrap

   1

   Use the annotation to enable the Otel data model, which is a Technology Preview feature.

   2

   Define the output type as lokiStack.

   3

   Specifies the OpenTelemetry data model.

   Note

   You cannot use lokiStack.labelKeys when dataModel is Otel. To achieve similar functionality when dataModel is Otel, refer to "Configuring LokiStack for OTLP data ingestion".