$ oc edit clusterlogging instance
In OKD 4, log curation is performed by Elasticsearch Curator, based on a retention policy that you define.
The Elasticsearch Curator tool removes Elasticsearch indices that use the data model prior to OKD 4. You can modify the Curator index retention policy for your old data.
You can specify the schedule for Curator using the Cluster Logging
custom resource
created by the OpenShift Logging installation.
OpenShift Logging and Elasticsearch must be installed.
To configure the Curator schedule:
Edit the ClusterLogging
custom resource in the openshift-logging
project:
$ oc edit clusterlogging instance
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
metadata:
name: "instance"
...
curation:
curator:
schedule: 30 3 * * * (1)
type: curator
1 | Specify the schedule for Curator in cron format. |
The time zone is set based on the host node where the Curator pod runs. |
You can configure Curator to delete Elasticsearch data that uses the data model prior to OKD 4. You can configure per-project and global settings. Global settings apply to any project not specified. Per-project settings override global settings.
OpenShift Logging must be installed.
To delete indices:
Edit the OKD custom Curator configuration file:
$ oc edit configmap/curator
Set the following parameters as needed:
config.yaml: |
project_name:
action
unit:value
The available parameters are:
Variable Name | Description |
---|---|
|
The actual name of a project, such as myapp-devel. For OKD operations
logs, use the name |
|
The action to take, currently only |
|
The period to use for deletion, |
|
The number of units. |
Variable Name | Description |
---|---|
|
Use |
|
The list of regular expressions that match project names. |
|
The valid and properly escaped regular expression pattern enclosed by single quotation marks. |
For example, to configure Curator to:
Delete indices in the myapp-dev project older than 1 day
Delete indices in the myapp-qe project older than 1 week
Delete operations logs older than 8 weeks
Delete all other projects indices after they are 31 days
old
Delete indices older than 1 day that are matched by the ^project\..+\-dev.*$
regex
Delete indices older than 2 days that are matched by the ^project\..+\-test.*$
regex
Use:
config.yaml: |
.defaults:
delete:
days: 31
.operations:
delete:
weeks: 8
myapp-dev:
delete:
days: 1
myapp-qe:
delete:
weeks: 1
.regex:
- pattern: '^project\..+\-dev\..*$'
delete:
days: 1
- pattern: '^project\..+\-test\..*$'
delete:
days: 2
When you use |