anchor.diff:  It may require several minutes, or hours, depending on the size of your
   journal, before any new log entries are available in Elasticsearch, when using
   `journal-read-from-head=true`.
  +====
  +
  +[WARNING]
  +====
  +It is highly recommended to use the default value for `use-journal`. In scenarios
  +where upgrading {product-title} changes the Docker log driver, if `use-journal=False`
  +was explicitly specified as part of installation, Fluentd would still expect to
  +read logs generated using the `json-file` log driver resulting in a lack of log
  +ingestion.
  +
  +If this has happened within your logging cluster see
  +xref:fluentd-upgrade-source[here] to troubleshoot.
   ====
   
   [[fluentd-log-external-elasticsearch]]
  
positive.code: this service account.
  ====
  
  . Ensure that port 9300 is open. By default the Elasticsearch service uses port 9300 for TCP communication between nodes in a cluster.  
  
  
  [[aggregate-logging-specifying-deployer-parameters]]
  
negative.code:   "https://localhost:9200/project.logging.3b3594fa-2ccd-11e6-acb7-0eb6b35eaee3.2016.06.15"
  ----
  ====
  
  [[fluentd-upgrade-source]]
  == Updating Fluentd's log source after Docker log driver update
  
  If the Docker log driver has changed from `json-file` to `journald`, and Fluentd
  was previously configured with `USE_JOURNAL=False` then it will not be able to
  pick up any new logs that are created. When the Fluentd daemonset is configured
  with the default value for `USE_JOURNAL` then it will detect the Docker log
  driver upon pod start up, and configure itself to pull from the appropriate source.
  
  To update Fluentd to detect the correct source upon start up:
  
  . Remove the label from nodes where Fluentd is deployed
  +
  ====
  ----
  $ oc label node --all logging-infra-fluentd- <1>
  ----
  <1> Assuming the default Fluentd node selector and it being deployed on all nodes
  ====
  
  . Update the daemonset/logging-fluentd USE_JOURNAL value to be empty
  +
  ====
  ----
  $ oc patch daemonset/logging-fluentd \
       -p '{"spec":{"template":{"spec":{"containers":[{"name":"fluentd-elasticsearch","env":[{"name": "USE_JOURNAL", "value":""}]}]}}}}'
  ----
  ====
  
  . Relabel your nodes to schedule Fluentd deployments
  +
  ====
  ----
  $ oc label node --all logging-infra-fluentd=true <1>
  ----
  <1> Assuming the default Fluentd node selector and it being deployed on all nodes
  ====
  