anchor.diff:  $ oc new-app logging-fluentd-template
   ----
   
  -[[fluentd-secure-forward]]
  -*Configuring Fluentd to send logs to an external log aggregator*
  -
  -Fluentd can be configured to send a copy of its logs to an external log aggregator
  -that can understand messages from Fluentd. This allows the ability to send logs
  -to data stores other than Elasticsearch and enables the ability to further process
  -log records after the {product-title} Fluentd has processed them.
  -
  -The `secure-forward` plugin has been provided with the Fluentd image as of
  +[[fluentd-external-log-aggregator]]
  +*Configuring Fluentd to Send Logs to an External Log Aggregator*
  +
  +You can configure Fluentd to send a copy of its logs to an external log
  +aggregator, and not the default Elasticsearch, using the `secure-forward`
  +plug-in. From there, you can further process log records after the locally
  +hosted Fluentd has processed them.
  +
   ifdef::openshift-origin[]
  -v1.4.0.
  +The `secure-forward` plug-in is provided with the Fluentd image as of v1.4.0.
   endif::openshift-origin[]
  -ifdef::openshift-enterprise[]
  -3.4.0.
  -endif::openshift-enterprise[]
  -
  -Along with this, the deployer provides a `secure-forward.conf` section in the
  -Fluentd configmap that can be updated using `$ oc edit configmap/logging-fluentd`
  -for shipping logs to an external aggregator.
  -
  -An example secure-forward.conf:
  +
  +The deployer provides a `secure-forward.conf` section in the Fluentd configmap
  +for configuring the external aggregator:
   
   ----
   @type secure_forward
  
positive.code: and can be configured to use
  link:https://www.elastic.co/guide/en/logstash/current/plugins-inputs-tcp.html#ssl_enable[SSL].
  
  Further explanation of how to set up the `fluent-plugin-secure-forward` plugin can be
  link:https://github.com/tagomoris/fluent-plugin-secure-forward[found here].
  
  [[fluentd-throttling]]
  *Throttling logs in Fluentd*
  
negative.code: </server>
  ----
  
  This can be updated using the `oc edit` command:
  
  ----
  $ oc edit configmap/logging-fluentd
  ----
  
  Certificates to be used in `secure-forward.conf` can be added to the existing
  secret that is mounted on the Fluentd pods. The `your_ca_cert` and
  `your_private_key` values must match what is specified in `secure-forward.conf`
  in `configmap/logging-fluentd`:
  
  ----
  $ oc patch secrets/logging-fluentd --type=json \
    --patch "[{'op':'add','path':'/data/your_ca_cert','value':'$(base64 /path/to/your_ca_cert.pem)'}]"
  $ oc patch secrets/logging-fluentd --type=json \
    --patch "[{'op':'add','path':'/data/your_private_key','value':'$(base64 /path/to/your_private_key.pem)'}]"
  ----
  
  [NOTE]
  ====
  Avoid using secret names such as 'cert', 'key', and 'ca' so that the values do
  not conflict with the keys generated by the Deployer pod for Fluentd to talk to
  the {product-title} hosted Elasticsearch.
  ====
  
  When configuring the external aggregator, it must be able to accept messages
  securely from Fluentd.
  
  If the external aggregator is another Fluentd process, it must have the
  `fluent-plugin-secure-forward` plug-in installed and make use of the input
  plug-in it provides:
  
  ----
  <source>
  