anchor.diff:  // Module included in the following assemblies:
   //
  -// * logging/cluster-logging-collector.adoc
  -
  -[id="cluster-logging-collector-external_{context}"]
  +// * logging/efk-logging-external.adoc
  +
  +[id="efk-logging-fluentd-external_{context}"]
   = Configuring Fluentd to send logs to an external log aggregator
   
   You can configure Fluentd to send a copy of its logs to an external log
  -aggregator, and not the default Elasticsearch, using the `secure-forward`
  +aggregator, and not the default Elasticsearch, using the *out_forward*
   plug-in. From there, you can further process log records after the locally
  -hosted Fluentd has processed them.
  +hosted Fluentd has processed them. 
   
   ifdef::openshift-origin[]
  -The `secure-forward` plug-in is provided with the Fluentd image as of v1.4.0.
  +The `forward` plug-in is provided with the Fluentd image as of v1.4.0.
  +The *in_forward* plug-in implements the server (receiving) side, and *out_forward* implements the client (sending) side.
   endif::openshift-origin[]
  -
  -////
   ifdef::openshift-enterprise[]
  -The `secure-forward` plug-in is supported by Fluentd only.
  +The `forward` plug-in is supported by Fluentd only.
  +The *in_forward* plug-in implements the server (receiving) side, and *out_forward* implements the client (sending) side.
   endif::openshift-enterprise[]
  -////
  -////
  -[NOTE]
  -====
  -For Rsyslog, you can edit the Rsyslog configmap to add support for Syslog log forwarding using the *omfwd* module, see link:https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html[omfwd: syslog Forwarding Output Module]. To send logs to a different Rsyslog instance, you can use the *omrelp* module, see link:https://www.rsyslog.com/doc/v8-stable/configuration/modules/omrelp.html[omrelp: RELP Output Module].
  -====
  -////
  -
  -The logging deployment provides a `secure-forward.conf` section in the Fluentd configmap
  -for configuring the external aggregator:
  +
  +To configure forwarding, edit the `secure-forward.conf` section in the Fluentd configmap in the `openshift-logging` project. On the external aggregator, configure the Fluentd `secure-forward.conf` file. For more information on using the *out_forward* plugin, see the link:https://docs.fluentd.org/output/forward[Fluentd documentation].
  +
  +.Default `secure-forward.conf` section
  +[source,yaml]
  +----
  +# <store>
  +#   @type forward
  +#   <security>
  +#     self_hostname ${hostname} # ${hostname} is a placeholder.
  +#     shared_key <shared_key_between_forwarder_and_forwardee>
  +#   </security>
  +#   transport tls
  +#   tls_verify_hostname true           # Set false to ignore server cert hostname.
  +
  +#   tls_cert_path /path/for/certificate/ca_cert.pem
  +#   <buffer>
  +#     @type file
  +#     path '/var/lib/fluentd/forward'
  +#     queued_chunks_limit_size "#{ENV['BUFFER_QUEUE_LIMIT'] || '1024' }"
  +#     chunk_limit_size "#{ENV['BUFFER_SIZE_LIMIT'] || '1m' }"
  +#     flush_interval "#{ENV['FORWARD_FLUSH_INTERVAL'] || '5s'}"
  +#     flush_at_shutdown "#{ENV['FLUSH_AT_SHUTDOWN'] || 'false'}"
  +#     flush_thread_count "#{ENV['FLUSH_THREAD_COUNT'] || 2}"
  +#     retry_max_interval "#{ENV['FORWARD_RETRY_WAIT'] || '300'}"
  +#     retry_forever true
  +#     # the systemd journald 0.0.8 input plugin will just throw away records if the buffer
  +#     # queue limit is hit - 'block' will halt further reads and keep retrying to flush the
  +#     # buffer to the remote - default is 'exception' because in_tail handles that case
  +#     overflow_action "#{ENV['BUFFER_QUEUE_FULL_ACTION'] || 'exception'}"
  +#   </buffer>
  +#   <server>
  +#     host server.fqdn.example.com  # or IP
  +#     port 24284
  +#   </server>
  +#   <server>
  +#     host 203.0.113.8 # ip address to connect
  +#     name server.fqdn.example.com # The name of the server. Used for logging and certificate verification in TLS transport (when host is address).
  +#   </server>
  +# </store>
  +----
   
   .Procedure
   
  
positive.code: not a path on your host system.
  ====
  +
  When configuring the external aggregator, it must be able to accept messages
  securely from Fluentd.
  +
  * If using Fluentd 1.0 or later, configure the built-in *in_forward* plug-in with the appropriate security parameters.
  +
  In Fluentd 1.0 and later, *in_forward* implements the server (receiving) side, and *out_forward* implements the client (sending) side.
  +
  For Fluentd versions 1.0 or higher, you can find further explanation of link:https://docs.fluentd.org/v1.0/articles/in_forward[how to set up the *inforward* plugin]
  and link:https://docs.fluentd.org/v1.0/articles/out_forward[the *out_forward* plugin].
  
  * If using Fluentd 0.12 or earlier, you must have the *fluent-plugin-secure-forward* plug-in installed and
  make use of the input plug-in it provides. In Fluentd 0.12, the same `fluent-plugin-secure-forward` plugin implements both the client (sending) side and the server (receiving) side.
  +
  For Fluentd 0.12 you can find further explanation of link:https://github.com/tagomoris/fluent-plugin-secure-forward[*fluent-plugin-secure-forward* plug-in in fluent-plugin-secure-forward repository].
  
negative.code: +
  ----
  secure-forward.conf: |
    # <store> 
    # @type secure_forward
  
    # self_hostname ${hostname}
  