bug: No option to turn on TLS in ClusterOutput for elastic search.

[anthonyoride]

Describe the issue

currently getting received plaintext http traffic on an https channel, closing connection Netty4HttpChannel on elastic search logs. i'm unable to turn on tls in the ClusterOutput for elastic search resource to see if this will fix this because the option to enable tls is not available in the spec section for elastic search (es) => https://github.com/fluent/fluent-operator/blob/master/docs/plugins/fluentbit/tls.md

To Reproduce

Below is my ClusterOutput resource

apiVersion: fluentbit.fluent.io/v1alpha2
kind: ClusterOutput
metadata:
name: k8s-app-es
labels:
fluentbit.fluent.io/enabled: "true"
fluentbit.fluent.io/mode: "k8s"
spec:
matchRegex: (?:kube|service).(.*)
es:
host: elastic-search-es-http.elastic-system.svc.cluster.local
port: 9200
generateID: true
index: fluent-bit
logstashPrefix: fluent-app-log-fb-only
logstashFormat: true
timeKey: "@timestamp"
traceError: true
replaceDots: true
type: _doc
httpUser:
valueFrom:
secretKeyRef:
name: elastic-creds
key: user
httpPassword:
valueFrom:
secretKeyRef:
name: elastic-creds
key: password

Expected behavior

the fluent operator docs provides the specs for the ClusterOutput resource for elastic search as seen here => https://github.com/fluent/fluent-operator/blob/master/docs/plugins/fluentbit/tls.md but an option to enable TLS is not available.

Your Environment

- Fluent Operator version: v2.5
- Container Runtime: crio
- Operating system: linux
- Kernel version:

How did you install fluent operator?

No response

Additional context

No response

[benjaminhuo]

@anthonyoride You can refer to each plugin's code: https://github.com/fluent/fluent-operator/blob/master/apis/fluentbit/v1alpha2/plugins/output/elasticsearch_types.go#L100

The tls config is included in almost every output's spec

[anthonyoride]

@benjaminhuo i know there is a TLS config. the question is how do i set it on?

[benjaminhuo]

@benjaminhuo i know there is a TLS config. the question is how do i set it on?

Add tls config fields to https://github.com/fluent/fluent-operator/blob/master/manifests/logging-stack/output-elasticsearch.yaml
@wenchajun @wanjunlei Is it correct to add tls config to es like below?
Do we have examples?

apiVersion: fluentbit.fluent.io/v1alpha2
kind: ClusterOutput
metadata:
  name: es
  labels:
    fluentbit.fluent.io/enabled: "true"
    fluentbit.fluent.io/component: logging
spec:
  matchRegex: (?:kube|service)\.(.*)
  es:
    host: elasticsearch-logging-data.kubesphere-logging-system.svc
    port: 9200
    generateID: true
    bufferSize: 20MB
    traceError: true
    logstashPrefix: ks-logstash-log
    logstashFormat: true
    timeKey: "@timestamp"
    tls:
      caPath: xxx
      keyFile: xxx

[wanjunlei]

https://github.com/fluent/fluent-operator/blob/master/apis/fluentbit/v1alpha2/plugins/output/elasticsearch_types.go#L100

The TLS enabled when tls is not nil.

[anthonyoride]

@wanjunlei Alright that's the response i want. thanks