Elon Cheng

like this ``` kind: Output metadata: annotations: labels: logging.kubesphere.io/component: events logging.kubesphere.io/enabled: 'true' name: opensearch-events namespace: kubesphere-logging-system spec: match: xxx opensearch: bufferSize: 20MB generateID: true host: opensearch-cluster-data.kubesphere-logging-system.svc httpPassword: valueFrom: secretKeyRef: key:...

Can you show the secret `fluentbit-config`?

Here, if set, logs will be collected for all namespaces that are set. If not set, the entire cluster logs will be collected. https://github.com/fluent/fluent-operator/blob/master/pkg/fluentd/router/route.go#L54

It's a good idea to maybe add a parameter to exclude some namespaces. `nonWatchNamespace`?

Check the es setting, you can refer to https://discuss.elastic.co/t/missing-authentication-for-rest-request/154807/2

The `collector ` and `fluentbit` configurations share a common set of crd's. We will improve the documentation in the future, and we welcome you to submit contributions.

You can refer to this https://github.com/fluent/fluent-plugin-opensearch/blob/main/README.Troubleshooting.md#cannot-connect-tls-enabled-reverse-proxy

There is no limit to the size of `app.conf` in `fluentd`, so perhaps this is a point that could be optimized.

After my testing, it seems that the underlying image is the cause here, and the exact cause is still being troubleshot. You can switch the image to `kubesphere/fluent-bit:v1.9.4` for now.

The error `/var/log/containers` is probably a problem with the mount path, and fluentbit is not mounted. You can set this https://github.com/fluent/fluent-operator/blob/c56cb02ef27231ebea37b62b4f40e794e7d9aa41/apis/fluentbit/v1alpha2/fluentbit_types.go#L77