openshift · johnwilkins · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026
diff --git a/.gitignore b/.gitignore
@@ -29,3 +29,4 @@ OBSDOCS-*_PLAN.md
 jira-token
 pull-jira-backlog.sh
 .jira-backlog/
+_work/
diff --git a/_topic_maps/_topic_map.yml b/_topic_maps/_topic_map.yml
@@ -42,8 +42,12 @@ Name: Configuring logging
 Dir: configuring
 Distros: openshift-logging
 Topics:
-- Name: Configuring the logging collector
-  File: cluster-logging-collector
+- Name: Configure the collector
+  File: configure-the-collector
+- Name: Configure collector network policies
+  File: configure-collector-network-policies
+- Name: Monitor collector metrics
+  File: monitor-collector-metrics
 - Name: Configuring log forwarding
   File: configuring-log-forwarding
 - Name: Configuring inputs
@@ -58,6 +62,10 @@ Topics:
   File: advanced-log-forwarding-configuration
 - Name: Forwarding to third-party systems
   File: forwarding-to-third-party-systems
+- Name: Forwarding from pods and projects
+  File: forwarding-from-pods-and-projects
+- Name: Forwarding logs over HTTP
+  File: forwarding-logs-over-http
 - Name: Forwarding to Google Cloud
   File: forwarding-to-google-cloud
 - Name: Forwarding to Splunk
@@ -70,10 +78,18 @@ Topics:
   File: forwarding-to-amazon-cloudwatch
 - Name: Collecting Kubernetes events
   File: collecting-kubernetes-events
-- Name: Configuring the log store
+- Name: About the LokiStack log store
+  File: about-the-lokistack-log-store
+- Name: Selecting an object storage provider for Loki
+  File: selecting-loki-storage-provider
+- Name: Configure the log store
   File: configuring-the-log-store
-- Name: Tuning the log store
-  File: tuning-the-log-store
+- Name: About log store tuning
+  File: about-log-store-tuning
+- Name: Tuning Loki for performance and scalability
+  File: tuning-loki-for-performance-and-scalability
+- Name: Configure Loki network policies
+  File: configuring-loki-network-policies
 - Name: Configuring LokiStack for OTLP
   File: configuring-lokistack-otlp
 - Name: OpenTelemetry data model
@@ -171,6 +187,8 @@ Topics:
   File: default-logging-alerts
 - Name: Custom logging alerts
   File: custom-logging-alerts
+- Name: Configuring Loki log-based alerts
+  File: configuring-loki-log-based-alerts
 #---
 #Name: Performance and reliability tuning
 #Dir: performance_reliability
@@ -196,6 +214,8 @@ Distros: openshift-logging
 Topics:
 - Name: Troubleshoot the installation
   File: troubleshoot-installation
+- Name: Troubleshoot the collector
+  File: troubleshoot-the-collector
 - Name: Troubleshoot log forwarding
   File: troubleshoot-log-forwarding
 - Name: Troubleshoot logging alerts

diff --git a/configuring/about-log-store-tuning.adoc b/configuring/about-log-store-tuning.adoc
@@ -0,0 +1,23 @@
+:_mod-docs-content-type: ASSEMBLY
+include::_attributes/common-attributes.adoc[]
+[id="about-log-store-tuning"]
+= About log store tuning
+
+:context: about-log-store-tuning
+
+toc::[]
+
+[role="_abstract"]
+You can configure advanced settings for Loki to optimize reliability, performance, scalability, security, and alerting in production environments.
+
+== Prerequisites
+
+* You have created a `LokiStack` custom resource.
+
+include::modules/understanding-lokistack-dashboards.adoc[leveloffset=+1]
+
+[role="_additional-resources"]
+.Additional resources
+
+* xref:../configuring/tuning-loki-for-performance-and-scalability.adoc#tuning-loki-for-performance-and-scalability[Tuning Loki for performance and scalability]
+* xref:../configuring/configuring-loki-network-policies.adoc#configuring-loki-network-policies[Configure Loki network policies]
diff --git a/configuring/about-the-lokistack-log-store.adoc b/configuring/about-the-lokistack-log-store.adoc
@@ -0,0 +1,26 @@
+:_mod-docs-content-type: ASSEMBLY
+include::_attributes/common-attributes.adoc[]
+[id="about-the-lokistack-log-store"]
+= About the LokiStack log store
+
+:context: about-the-lokistack-log-store
+
+toc::[]
+
+[role="_abstract"]
+Loki is a horizontally scalable, highly available, multitenant log aggregation system that you can use to store and query logs from your {product-title} cluster.
+
+include::snippets/loki-statement-snip.adoc[leveloffset=+1]
+
+include::modules/loki-output-format.adoc[leveloffset=+1]
+
+include::modules/loki-sizing.adoc[leveloffset=+1]
+
+include::modules/logging-identity-federation.adoc[leveloffset=+1]
+
+[role="_additional-resources"]
+.Additional resources
+
+* xref:../configuring/selecting-loki-storage-provider.adoc#selecting-loki-storage-provider[Selecting an object storage provider for Loki]
+* xref:../configuring/configuring-the-log-store.adoc#configuring-the-log-store[Configuring the log store]
+* xref:../configuring/about-log-store-tuning.adoc#about-log-store-tuning[About log store tuning]
diff --git a/configuring/advanced-log-forwarding-configuration.adoc b/configuring/advanced-log-forwarding-configuration.adoc
@@ -18,3 +18,9 @@ include::modules/setting-collector-log-level.adoc[leveloffset=+1]
 include::modules/setting-collector-resource-limits.adoc[leveloffset=+1]
 
 include::modules/creating-logfilesmetricexporter.adoc[leveloffset=+1]
+
+[role="_additional-resources"]
+.Additional resources
+
+* xref:../configuring/configuring-log-forwarding.adoc#configuring-log-forwarding[Configuring log forwarding]
+* xref:../troubleshooting/troubleshoot-log-forwarding.adoc#troubleshoot-log-forwarding[Troubleshooting log forwarding]
diff --git a/configuring/configure-collector-network-policies.adoc b/configuring/configure-collector-network-policies.adoc
@@ -0,0 +1,28 @@
+:_mod-docs-content-type: ASSEMBLY
+[id="configure-collector-network-policies"]
+= Configure collector network policies
+include::_attributes/common-attributes.adoc[]
+:context: configure-collector-network-policies
+
+toc::[]
+
+[role="_abstract"]
+You can configure network policies to enable the collector to operate in clusters with restrictive network configurations.
+
+include::modules/collector-network-policy.adoc[leveloffset=+1]
+
+include::modules/configuring-network-policy-rule-set-for-a-collector.adoc[leveloffset=+1]
+
+include::modules/logfilemetricexporter-network-policy.adoc[leveloffset=+1]
+
+include::modules/configuring-network-policy-rule-set-for-logfilemetricexporter.adoc[leveloffset=+1]
+
+include::modules/creating-an-adminnetworkpolicy-rule-for-collector-network-policy.adoc[leveloffset=+1]
+
+[role="_additional-resources"]
+.Additional resources
+
+* xref:../configuring/configure-the-collector.adoc#configure-the-collector[Configure the collector]
+* xref:../configuring/monitor-collector-metrics.adoc#monitor-collector-metrics[Monitor collector metrics]
+* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html-single/network_security/index#network-policy-apis[Understanding network policy APIs]
+* link:https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/network_security/index#ovn-k-anp[OVN-Kubernetes AdminNetworkPolicy]
diff --git a/configuring/configure-the-collector.adoc b/configuring/configure-the-collector.adoc
@@ -0,0 +1,50 @@
+:_mod-docs-content-type: ASSEMBLY
+[id="configure-the-collector"]
+= Configure the collector
+include::_attributes/common-attributes.adoc[]
+:context: configure-the-collector
+
+toc::[]
+
+[role="_abstract"]
+You can configure the log collector to receive logs from external sources, manage pod rollout strategy, and set resource limits.
+
+[id="cluster-logging-collector-input-receivers_{context}"]
+== Configure input receivers
+
+The {clo} deploys a service for each configured input receiver so that clients can write to the collector. This service exposes the port specified for the input receiver. For log forwarder `ClusterLogForwarder` CR deployments, the service name is in the `<clusterlogforwarder_resource_name>-<input_name>` format.
+
+[IMPORTANT]
+====
+Receiver inputs are only supported when logs originate from a Red{nbsp}Hat-supported product that is installed on the same cluster as the {CLO}, or when logging is installed on {hcp}.
+====
+
+The collector supports two types of receiver inputs:
+
+HTTP receiver::
+Receives and parses audit logs. Use this receiver when:
++
+* Logging is installed on {hcp}.
+* Logs originate from a Red{nbsp}Hat-supported product that is installed on the same cluster as the {CLO}. For example, {VirtProductName}.
+
+Syslog receiver::
+Receives and parses infrastructure logs in journal format. Use this receiver when:
++
+* Logs originate from a Red{nbsp}Hat-supported product that is installed on the same cluster as the {CLO}. For example:
+** Red Hat OpenStack Services on OpenShift (RHOSO)
+** {VirtProductName}
+
+include::modules/configuring-the-collector-to-receive-audit-logs-as-an-http-server.adoc[leveloffset=+2]
+
+include::modules/configuring-the-collector-to-listen-for-connections-as-a-syslog-server.adoc[leveloffset=+2]
+
+include::modules/configuring-pod-rollout-strategy.adoc[leveloffset=+1]
+
+include::modules/cluster-logging-collector-limits.adoc[leveloffset=+1]
+
+[role="_additional-resources"]
+.Additional resources
+
+* xref:../configuring/configure-collector-network-policies.adoc#configure-collector-network-policies[Configure collector network policies]
+* xref:../configuring/monitor-collector-metrics.adoc#monitor-collector-metrics[Monitor collector metrics]
+* xref:../configuring/configuring-inputs.adoc#configuring-inputs[Configuring inputs]
diff --git a/configuring/configuring-filters.adoc b/configuring/configuring-filters.adoc
@@ -22,3 +22,13 @@ include::modules/adding-a-prune-filter.adoc[leveloffset=+2]
 include::modules/about-multi-line-exceptions.adoc[leveloffset=+1]
 
 include::modules/enabling-multi-line-exception-detection.adoc[leveloffset=+1]
+
+[role="_additional-resources"]
+.Additional resources
+
+* xref:../configuring/configuring-log-forwarding.adoc#configuring-log-forwarding[Configuring log forwarding]
+* xref:../configuring/configuring-inputs.adoc#configuring-inputs[Configuring inputs]
+* xref:../configuring/configuring-outputs.adoc#configuring-outputs[Configuring outputs]
+* xref:../configuring/configuring-pipelines.adoc#configuring-pipelines[Configuring pipelines]
+* xref:../troubleshooting/troubleshoot-log-forwarding.adoc#troubleshoot-log-forwarding[Troubleshooting log forwarding]
+* link:https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/#audit-policy[Kubernetes audit policy]
diff --git a/configuring/configuring-inputs.adoc b/configuring/configuring-inputs.adoc
@@ -18,3 +18,12 @@ include::modules/input-spec-filter-labels-expressions.adoc[leveloffset=+1]
 include::modules/input-spec-filter-audit-infrastructure.adoc[leveloffset=+1]
 
 include::modules/adding-audit-log-collection.adoc[leveloffset=+1]
+
+[role="_additional-resources"]
+.Additional resources
+
+* xref:../configuring/configuring-log-forwarding.adoc#configuring-log-forwarding[Configuring log forwarding]
+* xref:../configuring/configuring-filters.adoc#configuring-filters[Configuring filters]
+* xref:../configuring/configuring-outputs.adoc#configuring-outputs[Configuring outputs]
+* xref:../configuring/configuring-pipelines.adoc#configuring-pipelines[Configuring pipelines]
+* xref:../troubleshooting/troubleshoot-log-forwarding.adoc#troubleshoot-log-forwarding[Troubleshooting log forwarding]
diff --git a/configuring/configuring-log-forwarding.adoc b/configuring/configuring-log-forwarding.adoc
@@ -30,151 +30,14 @@ include::modules/clf-about-status-conditions.adoc[leveloffset=+2]
 
 include::modules/verifying-log-collection.adoc[leveloffset=+2]
 
-// --- Phase 4: Configuring the Pipeline (I/O Flow) ---
-
-[id="configuring-inputs_{context}"]
-== Configuring inputs
-
-include::modules/clf-inputs-reference.adoc[leveloffset=+2]
-
-include::modules/input-spec-filter-namespace-container.adoc[leveloffset=+2]
-
-include::modules/input-spec-filter-labels-expressions.adoc[leveloffset=+2]
-
-include::modules/input-spec-filter-audit-infrastructure.adoc[leveloffset=+2]
-
-include::modules/adding-audit-log-collection.adoc[leveloffset=+2]
-
-[id="configuring-filters_{context}"]
-== Configuring filters
-
-include::modules/clf-filters-reference.adoc[leveloffset=+2]
-
-include::modules/logging-audit-log-filtering.adoc[leveloffset=+2]
-
-include::modules/filtering-collected-logs.adoc[leveloffset=+2]
-
-include::modules/adding-a-drop-filter.adoc[leveloffset=+3]
-
-include::modules/adding-a-prune-filter.adoc[leveloffset=+3]
-
-include::modules/about-multi-line-exceptions.adoc[leveloffset=+2]
-
-include::modules/enabling-multi-line-exception-detection.adoc[leveloffset=+2]
-
-[id="configuring-outputs_{context}"]
-== Configuring outputs
-
-include::modules/clf-outputs-reference.adoc[leveloffset=+2]
-
-[id="configuring-pipelines_{context}"]
-== Configuring pipelines
-
-include::modules/clf-pipelines-reference.adoc[leveloffset=+2]
-
-// --- Phase 5: Advanced Configuration ---
-
-[id="advanced-configuration_{context}"]
-== Advanced configuration
-
-include::modules/configuring-rate-limits.adoc[leveloffset=+2]
-
-include::modules/logging-delivery-tuning.adoc[leveloffset=+2]
-
-include::modules/setting-collector-log-level.adoc[leveloffset=+2]
-
-include::modules/setting-collector-resource-limits.adoc[leveloffset=+2]
-
-include::modules/creating-logfilesmetricexporter.adoc[leveloffset=+2]
-
-// --- Phase 6: Troubleshooting ---
-
-include::modules/troubleshooting-log-collection.adoc[leveloffset=+1]
-
-// --- Phase 7: Third-Party Output Configuration (Detailed Procedures) ---
-
-[id="forwarding-to-third-party-destinations_{context}"]
-== Forwarding to third-party destinations
-
-include::modules/logging-external-destination-compatibility.adoc[leveloffset=+2]
-
-include::modules/cluster-logging-collector-log-forwarding-about.adoc[leveloffset=+2]
-
-include::modules/cluster-logging-collector-log-forward-gcp.adoc[leveloffset=+2]
-
-include::modules/cluster-logging-collector-log-forward-gcp-wif.adoc[leveloffset=+2]
-
-include::modules/configuring-otlp-output.adoc[leveloffset=+2]
-
-[id="forwarding-logs-to-splunk_{context}"]
-=== Forwarding logs to Splunk
-
-include::modules/logging-forward-splunk.adoc[leveloffset=+3]
-
-include::modules/default-splunk-metadata-key-values.adoc[leveloffset=+3]
-
-include::modules/logging-http-forward.adoc[leveloffset=+2]
-
-include::modules/cluster-logging-collector-log-forward-loki.adoc[leveloffset=+2]
-
-include::modules/cluster-logging-collector-log-forward-kafka.adoc[leveloffset=+2]
-
-include::modules/about-azure-logs-ingestion-api.adoc[leveloffset=+2]
-
-include::modules/azure-logs-ingestion-dcr-requirements.adoc[leveloffset=+2]
-
-include::modules/azure-dcr-components.adoc[leveloffset=+3]
-
-include::modules/azure-dcr-required-information.adoc[leveloffset=+3]
-
-include::modules/azure-dcr-authentication-permissions.adoc[leveloffset=+3]
-
-include::modules/azure-logs-ingestion-authentication.adoc[leveloffset=+2]
-
-include::modules/azure-auth-client-secret.adoc[leveloffset=+3]
-
-include::modules/azure-auth-workload-identity.adoc[leveloffset=+3]
-
-include::modules/azure-auth-permissions.adoc[leveloffset=+3]
-
-include::modules/logging-forwarding-azure-logs-ingestion.adoc[leveloffset=+2]
-
-include::modules/logging-forwarding-azure.adoc[leveloffset=+2]
-
-include::modules/cluster-logging-collector-log-forward-project.adoc[leveloffset=+2]
-
-include::modules/cluster-logging-collector-log-forward-logs-from-application-pods.adoc[leveloffset=+2]
-
-include::modules/cluster-logging-collector-log-forward-syslog.adoc[leveloffset=+3]
-
-include::modules/cluster-logging-collector-log-forward-syslog-rfc5424-defaults.adoc[leveloffset=+3]
-
-include::modules/cluster-logging-collector-log-forward-syslog-log-source.adoc[leveloffset=+3]
-
-include::modules/cluster-logging-collector-log-forward-cloudwatch.adoc[leveloffset=+2]
-
-include::modules/forwarding-logs-to-amazon-s3-endpoint.adoc[leveloffset=+2]
-
-[id="forwarding-logs-to-amazon-cloudwatch-from-sts-enabled-clusters_{context}"]
-=== Forwarding logs to Amazon CloudWatch from STS-enabled clusters
-
-include::modules/creating-an-aws-role.adoc[leveloffset=+3]
-
-include::modules/cluster-logging-collector-log-forward-secret-cloudwatch.adoc[leveloffset=+3]
-
-include::modules/cluster-logging-collector-log-forward-sts-cloudwatch.adoc[leveloffset=+3]
-
-include::modules/forwarding-logs-to-amazon-s3-endpoint-from-sts-enabled-clusters.adoc[leveloffset=+3]
-
-include::modules/cross-account-log-forwarding-with-assumerole.adoc[leveloffset=+3]
-
-include::modules/configuring-aws-iam-for-cross-account-access.adoc[leveloffset=+3]
-
-include::modules/example-clusterlogforwarder-configuration-for-cross-account-forwarding.adoc[leveloffset=+3]
-
-include::modules/cross-account-log-forwarding-troubleshooting.adoc[leveloffset=+3]
-
 [role="_additional-resources"]
 .Additional resources
 
+* xref:../configuring/configuring-inputs.adoc#configuring-inputs[Configuring inputs]
+* xref:../configuring/configuring-filters.adoc#configuring-filters[Configuring filters]
+* xref:../configuring/configuring-outputs.adoc#configuring-outputs[Configuring outputs]
+* xref:../configuring/configuring-pipelines.adoc#configuring-pipelines[Configuring pipelines]
+* xref:../configuring/advanced-log-forwarding-configuration.adoc#advanced-log-forwarding-configuration[Advanced log forwarding configuration]
+* xref:../configuring/forwarding-to-third-party-systems.adoc#forwarding-to-third-party-systems[Forwarding to third-party systems]
+* xref:../troubleshooting/troubleshoot-log-forwarding.adoc#troubleshoot-log-forwarding[Troubleshooting log forwarding]
 * xref:../configuring/opentelemetry-data-model.adoc#opentelemetry-data-model[OpenTelemetry data model]