anchor.diff:  controller], so you can link:../dev_guide/deployments.html#scaling[scale] the
   *Elasticsearch* cluster up and down as required.
   
  -You'll need a privileged service account to launch the current ElasticSearch image,
  -as it runs as root (which should be corrected in time). Create a file with these contents:
  -
  +You will need a privileged link:service_accounts.html[service account] to launch
  +the current *ElasticSearch* image, as it runs as root (which should be corrected
  +in time). First, create a file with the following contents:
   
   ====
   
  
positive.code: ----
  ====
  
  Save this to a file and create it:
  
  ====
  ----
  
negative.code: If the value for `docs.count` is more than 0, then log records are being
  correctly sent to *Elasticsearch*.
  
  If not, it is usually because the *fluentd* container cannot reach the
  *ElasticSearch* service. There may be a bug currently that causes name
  resolution to fail. Check `oc logs` for the *fluentd* pod. The log may report
  something like:
  
  ====
  ----
      temporarily failed to flush the buffer.  [...]
          error="Can not reach Elasticsearch cluster ({:host=>\"es-logging\", :port=>9200, :scheme=>\"http\"})!
          getaddrinfo: Name does not resolve (SocketError)"
  ----
  ====
  
  To work around this, you can modify the *fluentd* static pod definition to point
  the `*ES_HOST*` variable at the IP for the *es-logging* service instead of its
  name. It should be redeployed within 10 seconds.
  
  [[creating-the-kibana-service]]
  
  === Creating the Kibana Service
  
  To create the *Kibana* service, first create a file with the following contents:
  
  ====
  
  