OpenShift Fluentd to Splunk

Table of Contents

• Overview
• Bill of Materials
  • Environment Specifications
• Setup Instructions
• Presenter Notes
  • Environment Setup
  • Create Build Configuration and Image
  • Update Existing ConfigMap
  • Update Existing Daemon Set
  • Redeploy Fluentd Pods
• Resources

Overview

OpenShift can be configured to host an EFK stack that stores and indexes log data but at some sites a log aggregation system is already in place. The default OpenShift fluetnd image can be modified to directly forward messages to Splunk. Currenly the disadvantages of this method are no filter can be done so all messages are sent to Splunk.

Bill of Materials

Environment Specifications

This quickstart should be run on an installation of OpenShift Enterprise V3 with an existing EFK deployment.

Setup Instructions

Environment Setup

The EFK stack should already be configured in the logging namespace.

Create Build Configuration and Image

Run the following commands to create the build configuration and ImageStream.

oc project logging
oc new-app registry.access.redhat.com/openshift3/logging-fluentd:latest~https://github.com/themoosman/openshift-fluentd-splunk.git

Update Existing ConfigMap

Add the following section to the ConfigMap to create a new splunk configuration file. The example below will only forward kubernetes messages. To forward all messages just use the <store> block without the filter.

Update the host with the correct Splunk hostname.

output-extra-splunk.conf: |
  <store kubernetes.**>
    @type splunk_ex
    host mysplunkserver
    port 9997
    output_format json
  </store>

Update Existing Daemon Set

Update the logging-fluentd daemonset to use new fluentd image

containers:
  - name: fluentd-elasticsearch
    image: 'logging/openshift-fluentd-splunk:latest'

Redeploy Fluentd Pods

Run the following commands to redeploy the fluentd pods.

oc project logging
oc delete pod -l component=fluentd

Resources

• Secure Forwarding with Splunk
• Origin Fluentd Image Source
• Fluentd Filter Plugin Overview