Provide an ELK based log management solution as part of the base Business Automation Content Services on Cloud (BACSOC) as the current logging solution isn't practically usabe

Current Behaviour

Currently the Bacsoc SaaS solution provides logs via a portal page named System Operations and provides facilities for retrieving logs from Navigator, Studio, Content Platform Engine, Content Search Services, Content Services GraphQL, Content Management Interoperability Services.  You can retrieve a log for each system for periods of 15 minutes, 30 minutes, 1 hour, 4 hours, 8 hours, or 24 hours from the current time.

Issues with Current Behaviour

This approach does not provide a practical means of retrieving, analysing or using any of the logging information for the following reasons:

• There is no capability to retrieve logs from more than 24 hours ago limiting the ability to analyse root causes of many component issues.
• The entire log for a period must be retrieved when only a portion of any of it would be useful. If I simply want to see something that occurred 6 hours ago (for example).  I can’t target the specific time I want and must retrieve and process an entire log file.
• If an issue impacts multiple components, it's likely that this entire log retrieval would be necessary for multiple components.
• The logs for each separate component use different formats – some use Filebeat ECS JSON wrapped liberty, some use native Open Liberty JSON.
• Most of the log content is format wrapping which means the size of the log and its ability to be understood is dependent on further unwrapping or processing, adding to the effort to use the information and the time necessary to isolate specific issues.

Enhancement

The enhancement request is to include a full ELK container stack into the Bacsoc deployment.  Rather than downloading the logs, ingest them and store them in ElasticSearch and then provide a facility to create customer configured Kibana dashboards that can be used to interrogate the logs sensibly, across all components within a time range.  Downloading and trawling through the downloaded log information is time consuming, error prone and clumsy.  Correlating the information across the different log files for each component is equally clumsy and  significantly increases the time needed to identify issues and work through problem resolution.

Providing a simple ELK stack within the platform has very little technical overhead and would significantly improve the ability of managing the Bacsoc components.  It would align better with good practice and would significantly improve the manageability of the platform for both customers and IBM support