[kolla] [kolla-ansible] fluentd doesn't forward OpenStack logs to Elasticsearch

Bernd Bausch berndbausch at gmail.com
Sat May 29 10:23:02 UTC 2021

I might have found a bug in Kolla-Ansible (Victoria version) but don't 
know where to file it.

This is about central logging. In my installation, none of the 
interesting logs (Nova, Cinder, Neutron...) are sent to Elasticsearch. I 
confirmed that using tcpdump.

I found that fluentd's config file /etc/kolla/fluentd/td-agent.conf tags 
these logs with "kolla.*". But later in the file, one finds filters like 

# Included from conf/filter/01-rewrite-0.14.conf.j2:
<match kolla.var.log.kolla.*.*.log>
     @type rewrite_tag_filter
     capitalize_regex_backreference yes
     key     programname
     tag openstack_python

If I understand this right, this basically re-tags all nova logs with 

The same config file has an output rule at the very end. I think the 
intention is to make this a catch-all rule (or "match anything else"):

# Included from conf/output/01-es.conf.j2:
<match *.**>
     @type copy
        @type elasticsearch
        port 9200
        scheme http


Unfortunately, the /openstack_python/ tag doesn't match /*.**/, since it 
contains no dot.  I fixed this with <match **>. Now I receive all logs, 
but I am not sure if this is the right way to fix it.

The error, if it is one, is in 

If you want me to file a bug, please let me know how.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-discuss/attachments/20210529/63650b09/attachment.html>

More information about the openstack-discuss mailing list