# Logging

This documentation contains backend development guides for interaction with key components behind KubeSphere logging system. Logging backend provides the capabilities of:
 
 - Log search
 - Log export
 - Log output configuration
 - Multi-tenant isolation

## File Tree

The listing below covers all folders related to the logging backend.

```
/pkg
  ├─api
  │  └─logging            # declares structs for api responses
  │     └─v1alpha2             
  ├─apiserver             # implements handler for http requests
  │  ├─logging            
  │  └─tenant
  ├─kapis                 # registers APIs and routing
  │  ├─logging
  │  │  ├─install
  │  │  └─v1alpha2
  │  ├─tenant
  │  │  ├─install
  │  │  └─v1alpha2
  ├─models                
  │  ├─log                # constants, utils and fluent-bit crd operation
  │  │  ├─constants.go
  │  │  ├─logcollector.go # some utils
  │  │  ├─logcrd.go       # interacts with fluent-bit crd
  │  │  └─types.go
  │  └─tenant
  └─simple
     ├─factory.go         # contains factory functions for es client options
     └─client
        ├─elasticsearch   # wraps es search apis
        │  ├─esclient.go  # constructs es search body 
        │  ├─interface.go # general interface methods for es clients
        │  ├─options.go   # es client options
        │  └─versions     # client code by es versions
        │     ├─v5
        │     ├─v6
        │     └─v7
        └─fluentbit       # autogenerated client code for fluent-bit crd
```

## API Design

There are two types of APIs in logging. One for log query, and the other for interacting with the CustomResourceDefinition used by [Fluent-bit Operator](https://github.com/kubesphere/fluentbit-operator). For information about CRD and Fluent-bit Operator, please go to its own repo.
 
To support multi-tenant isolation, KubeSphere's logging query APIs have the format like below, though the underlying logic is using Elastic Search APIs:
  
```
GET /namespaces/{namespace}/pods/{pod}/containers/{container}
```

KubeSphere API gateway will decode the URL and conduct authorization. A person who doesn't belong to a namespace will be rejected to make a request.