Some environments do not leverage the Elasticsearch instance available via the OCP logging operator, there should be an option to remove it from the LogForwarding CR created
Actually, this appears to be possible by settings openshift.forwarding.audit.elasticsearch, openshift.forwarding.app.elasticsearch and openshift.forwarding.infra.elasticsearch all to false
Some environments do not leverage the Elasticsearch instance available via the OCP logging operator, there should be an option to remove it from the
LogForwarding
CR created