How to collect log data of a specific namespace in Openshift?

Question

I have a cluster with many namespaces. I'm trying to log data from a specific namespace in my Openshift cluster but it is logging the data from all the namespaces. I tried to follow the documentation of the Openshift regarding logging, but there is no mention of scoping the log data.

I followed this documentation: https://docs.openshift.com/container-platform/4.7/logging/cluster-logging.html

I'm using fluentd as the log collector.

Answer 1

As Cluster Logging on OpenShift, you can transfer logs in namespaces or Pods matched label you select.

The sample CR like Forward logs in my-project namespace to Elasticserach which is deployed by Cluster Logging could be as follows:

apiVersion: "logging.openshift.io/v1"
kind: ClusterLogForwarder
metadata:
  name: instance 
  namespace: openshift-logging 
spec:
  inputs: 
   - name: my-app-logs
     application:
        namespaces:
        - my-project
  pipelines:
   - name: my-app 
     inputRefs:
      - my-app-logs
     outputRefs:
      - default

You can customize inputs field as you want. It also could be specified Pods using matchLabels expression. *2

outputs default means send logs to default Elasticsearch on Cluster Logging.

*1: https://docs.openshift.com/container-platform/4.11/logging/cluster-logging-external.html

*2: https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-external.html#cluster-logging-collector-log-forward-logs-from-application-pods_cluster-logging-external