anchor.diff:  not a path on your host system.
   ====
   +
  -When configuring the external aggregator, it must be able to accept messages
  -securely from Fluentd.
  -+
  -* If using Fluentd 1.0 or later, configure the built-in *in_forward* plug-in with the appropriate security parameters.
  -+
  -In Fluentd 1.0 and later, *in_forward* implements the server (receiving) side, and *out_forward* implements the client (sending) side.
  -+
  -For Fluentd versions 1.0 or higher, you can find further explanation of link:https://docs.fluentd.org/v1.0/articles/in_forward[how to set up the *inforward* plugin]
  -and link:https://docs.fluentd.org/v1.0/articles/out_forward[the *out_forward* plugin].
  -
  -* If using Fluentd 0.12 or earlier, you must have the *fluent-plugin-secure-forward* plug-in installed and
  +For example:
  ++
  +----
  +$ oc patch secrets/fluentd --type=json \
  +  --patch "[{'op':'add','path':'/data/ca.crt','value':'$(base64 /etc/fluent/keys/ca.crt)'}]"
  +$ oc patch secrets/fluentd --type=json \
  +  --patch "[{'op':'add','path':'/data/ext-agg','value':'$(base64 /etc/fluent/keys/ext-agg.pem)'}]"
  +----
  +
  +. Configure the `secure-forward.conf` file on the external aggregator to accept messages securely from Fluentd.
  ++
  +When configuring the external aggregator, it must be able to accept messages securely from Fluentd.
  +
  +You can find further explanation of link:https://docs.fluentd.org/v1.0/articles/in_forward[how to set up the *inforward* plugin] and link:https://docs.fluentd.org/v1.0/articles/out_forward[the *out_forward* plugin].
  +
  +////
  +* If using Fluentd 0.12 or earlier, you must have the *fluent-plugin-secure-forward* plug-in installed and 
   make use of the input plug-in it provides. In Fluentd 0.12, the same `fluent-plugin-secure-forward` plugin implements both the client (sending) side and the server (receiving) side.
   +
   For Fluentd 0.12 you can find further explanation of link:https://github.com/tagomoris/fluent-plugin-secure-forward[*fluent-plugin-secure-forward* plug-in in fluent-plugin-secure-forward repository].
  
positive.code: +
  ----
  secure-forward.conf: |
    # <store>
    # @type secure_forward
  
    # self_hostname ${hostname}
  
negative.code: 
  . Edit the `secure-forward.conf` section of the Fluentd configuration map:
  +
  ----
  $ oc edit configmap/fluentd -n openshift-logging
  ----
  
  . Enter the name, host, and port for your external Fluentd server:
  +
  [source,yaml]
  ----
  #   <server>
  #     host server.fqdn.example.com  # or IP
  #     port 24284
  #   </server>
  #   <server>
  #     host 203.0.113.8 # ip address to connect
  #     name server.fqdn.example.com # The name of the server. Used for logging and certificate verification in TLS transport (when host is address).
  #   </server>
  ----
  +
  For example:
  +
  [source,yaml]
  ----
    <server> 
      name externalserver1 <1>
      host 192.168.1.1 <2>
      port 24224 <3>
    </server>
    <server> <4>
      name externalserver1
      host 192.168.1.2
      port 24224
    </server>
  </store>
  ----
  <1> Optionally, enter a name for this external aggregator.
  <2> Specify the host name or IP of the external aggregator.
  <3> Specify the port of the external aggregator.
  <4> Optionally, add additional external aggregator. 
  
  
  . Add the path to your CA certificate and private key to the `secure-forward.conf` section:
  +
  [source,yaml]
  ----
  #   <security>
  #     self_hostname ${hostname} # ${hostname} is a placeholder. <1>
  #     shared_key <shared_key_between_forwarder_and_forwardee> <2>
  #   </security>
  
  #   tls_cert_path /path/for/certificate/ca_cert.pem <3>
  ----
  <1> Specify the default value of the auto-generated certificate common name (CN).
  <2> Specify a shared key for authentication.
  <3> Specify the path to your CA certificate.
  +
  For example:
  +
  [source,yaml]
  ----
     <security>
       self_hostname client.fqdn.local
       shared_key cluster_logging_key 
     </security>
  
     tls_cert_path /etc/fluent/keys/ca.crt
  ----
  +
  To use mTLS, see the link:https://docs.fluentd.org/output/forward#tips-and-tricks[Fluentd documentation] for information about client certificate and key parameters and other settings.
   
  . Add certificates to be used in `secure-forward.conf` to the existing
  secret that is mounted on the Fluentd pods. The `your_ca_cert` and
  `your_private_key` values must match what is specified in `secure-forward.conf`
  in `configmap/fluentd`:
  +
  ----
  $ oc patch secrets/fluentd --type=json \
  