Multiple Logstash outputs vs pipeline-to-pipeline communcations

Hi folks,

I have following use case:

I want to create one index for each kubernetes namespace (and its own lifecycle policy) and I want to use the ILM. As far as I understand I have two approaches:

  1. I have one pipeline config file, lets say kubernetes-logs.conf in which I have an output consisting of if else statements and the respective index settings for the namespace logs such as rollover_alias, ilm_pattern.
  2. I have different pipeline config files, one per namespace. And I use pipeline-to-pipeline communication to redirect the traffic to different pipelines inside the pipelines.yml

Do you have any hints which approach is better in terms of ressource consumption?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.