docs: add economizing log forwarding guide with measured savings data - #3395
docs: add economizing log forwarding guide with measured savings data#3395Clee2691 wants to merge 1 commit into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughChangesAdds documentation for measuring log-forwarding costs, selecting fields for pruning, and applying balanced or minimal ChangesEconomizing log forwarding
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
PR Summary by QodoAdd economizing log forwarding guide with tiered CLF pruning samples
AI Description
Diagram
High-Level Assessment
Files changed (11)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@docs/administration/economizing-log-forwarding/economizing-log-forwarding.md`:
- Around line 51-65: Update the documented prune-filter paths in the field
tables to use valid ClusterLogForwarder FieldPath syntax by quoting every
segment containing @, dots, or slashes, including nested examples such as
annotations and user.extra paths. Apply this consistently to all affected
entries in the table, while leaving simple alphanumeric segments unquoted.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 67c23629-978c-4d7b-aa12-141b6335134e
⛔ Files ignored due to path filters (6)
docs/administration/economizing-log-forwarding/images/bloat-ratio.pngis excluded by!**/*.pngdocs/administration/economizing-log-forwarding/images/bytes-by-log-group.pngis excluded by!**/*.pngdocs/administration/economizing-log-forwarding/images/cpu-timeseries.pngis excluded by!**/*.pngdocs/administration/economizing-log-forwarding/images/field-cost-breakdown.pngis excluded by!**/*.pngdocs/administration/economizing-log-forwarding/images/mem-timeseries.pngis excluded by!**/*.pngdocs/administration/economizing-log-forwarding/images/total-savings.pngis excluded by!**/*.png
📒 Files selected for processing (5)
docs/administration/economizing-log-forwarding/economizing-log-forwarding.mddocs/administration/economizing-log-forwarding/methodology.mddocs/administration/economizing-log-forwarding/output-field-requirements.mddocs/reference/samples/observability.economize-balanced.yamldocs/reference/samples/observability.economize-minimal.yaml
| | `.kubernetes.annotations.k8s.ovn.org/pod-networks` | 387 | 19.2% | 38% | | ||
| | `.kubernetes.annotations.k8s.v1.cni.cncf.io/network-status` | 169 | 8.4% | 38% | | ||
| | `.message` | 162 | 8.1% | 100% | | ||
| | `.kubernetes.container_image` | 118 | 5.9% | 100% | | ||
| | `.kubernetes.container_id` | 72 | 3.6% | 100% | | ||
| | `.kubernetes.annotations.imageregistry.operator.openshift.io/dependencies-checksum` | 71 | 3.5% | 3% | | ||
| | `.kubernetes.annotations.network.operator.openshift.io/ovnkube-script-lib-hash` | 40 | 2.0% | 6% | | ||
| | `.kubernetes.pod_owner` | 37 | 1.9% | 100% | | ||
| | `.hostname` | 37 | 1.8% | 100% | | ||
| | `.kubernetes.namespace_id` | 36 | 1.8% | 100% | | ||
| | `.kubernetes.pod_id` | 36 | 1.8% | 100% | | ||
| | `.openshift.cluster_id` | 36 | 1.8% | 100% | | ||
| | `.kubernetes.pod_name` | 32 | 1.6% | 100% | | ||
| | `.@timestamp` | 30 | 1.5% | 100% | | ||
| | `.kubernetes.namespace_labels.kubernetes_io_metadata_name` | 24 | 1.2% | 100% | |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Use valid ClusterLogForwarder FieldPath syntax.
These tables show paths that users can copy into prune filters. Quote every segment that contains @, dots, or slashes. Otherwise, CRD validation rejects the filter.
Proposed documentation update
-| `.kubernetes.annotations.k8s.ovn.org/pod-networks` | 387 | 19.2% | 38% |
-| `.@timestamp` | 30 | 1.5% | 100% |
+| `.kubernetes.annotations."k8s.ovn.org/pod-networks"` | 387 | 19.2% | 38% |
+| `."`@timestamp`"` | 30 | 1.5% | 100% |Apply the same rule to paths such as .annotations."authorization.k8s.io/reason" and .user.extra."authentication.kubernetes.io/credential-id".
Also applies to: 86-105
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/administration/economizing-log-forwarding/economizing-log-forwarding.md`
around lines 51 - 65, Update the documented prune-filter paths in the field
tables to use valid ClusterLogForwarder FieldPath syntax by quoting every
segment containing @, dots, or slashes, including nested examples such as
annotations and user.extra paths. Apply this consistently to all affected
entries in the table, while leaving simple alphanumeric segments unquoted.
There was a problem hiding this comment.
added a note about needing to quote certain field paths
There was a problem hiding this comment.
@Clee2691, thank you. I noted the documentation guidance. Quote each ClusterLogForwarder FieldPath segment that contains @, dots, or slashes.
✏️ Learnings added
Learnt from: Clee2691
Repo: openshift/cluster-logging-operator PR: 3395
File: docs/administration/economizing-log-forwarding/economizing-log-forwarding.md:60-74
Timestamp: 2026-08-10T18:30:56.627Z
Learning: In `docs/administration/economizing-log-forwarding/` documentation for OpenShift `ClusterLogForwarder` prune filters, FieldPath segments that contain `@`, dots, or slashes must be quoted. Examples include `."`timestamp`"`, `.annotations."authorization.k8s.io/reason"`, and `.user.extra."authentication.kubernetes.io/credential-id"`.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
You are interacting with an AI system.
There was a problem hiding this comment.
added a note about needing to quote certain field paths
@Clee2691 I feel this caveat is already in the Red Hat docs in - https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4/html/configuring_logging/configuring-log-forwarding#adding-a-prune-filter_configuring-log-forwarding
Code Review by Qodo
1.
|
![qodo-for-rh-openshift[bot]](https://avatars.githubusercontent.com/u/792337?s=60&v=4){kind=small}
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Clee2691 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@Clee2691: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Description
This PR adds an economizing log forwarding guide with two recommended CLF configurations (balanced and minimal) for reducing log volume via field pruning, backed by measured data from a 6-node OCP cluster.
Accompanying plan/scripts: https://github.com/Clee2691/clo_investigations/tree/LOG-9673
/cc @vparfonov @r2d2rnd
/assign @jcantrill
Links
Summary by CodeRabbit
ClusterLogForwarderexamples for routing and pruning application, infrastructure, journal, and audit logs.