anchor.diff:  and can be configured to use
   link:https://www.elastic.co/guide/en/logstash/current/plugins-inputs-tcp.html#ssl_enable[SSL].
   
  -Further explanation of how to set up the `fluent-plugin-secure-forward` plugin can be
  -link:https://github.com/tagomoris/fluent-plugin-secure-forward[found here].
  +Further explanation of how to set up the `fluent-plugin-secure-forward` plug-in
  +can be link:https://github.com/tagomoris/fluent-plugin-secure-forward[found
  +here].
   
   [[fluentd-throttling]]
   *Throttling logs in Fluentd*
  
positive.code: </server>
  ----
  
  Certificates to be used in `secure-forward.conf` can be added to the existing secret
  that is mounted on the Fluentd pods:
  
  ----
  $ oc patch secrets/logging-fluentd --type=json --patch "[{'op':'add','path':'/data/your_ca_cert','value':'$(base64 /path/to/your_ca_cert.pem)'}]"
  $ oc patch secrets/logging-fluentd --type=json --patch "[{'op':'add','path':'/data/your_private_key','value':'$(base64 /path/to/your_private_key.pem)'}]"
  ----
  
  [NOTE]
  ====
  The name provided on the path above (e.g. your_ca_cert, your_private_key)
  will need to match what is specified within `secure-forward.conf` in
  configmap/logging-fluentd.
  
  Avoid using secret names such as 'cert', 'key', 'ca' so not to clobber the keys
  that were generated by the Deployer pod for Fluentd to talk to the {product-title}
  hosted Elasticsearch.
  ====
  
  When configuring the external aggregator, it will need to be able to accept messages
  securely from Fluentd.
  
  If the external aggregator is another Fluentd process, it will need to have the
  `fluent-plugin-secure-forward` plugin installed and make use of the input plugin
  it provides. Such as:
  
  ----
  <source>
  
negative.code: $ oc new-app logging-fluentd-template
  ----
  
  [[fluentd-external-log-aggregator]]
  *Configuring Fluentd to Send Logs to an External Log Aggregator*
  
  You can configure Fluentd to send a copy of its logs to an external log
  aggregator, and not the default Elasticsearch, using the `secure-forward`
  plug-in. From there, you can further process log records after the locally
  hosted Fluentd has processed them.
  
  ifdef::openshift-origin[]
  The `secure-forward` plug-in is provided with the Fluentd image as of v1.4.0.
  endif::openshift-origin[]
  
  The deployer provides a `secure-forward.conf` section in the Fluentd configmap
  for configuring the external aggregator:
  
  ----
  @type secure_forward
  