Multiple Logstash outputs vs pipeline-to-pipeline communcations

Elastic Stack Logstash
1

Hi folks,

I have following use case:

I want to create one index for each kubernetes namespace (and its own lifecycle policy) and I want to use the ILM. As far as I understand I have two approaches:

  1. I have one pipeline config file, lets say kubernetes-logs.conf in which I have an output consisting of if else statements and the respective index settings for the namespace logs such as rollover_alias, ilm_pattern.
  2. I have different pipeline config files, one per namespace. And I use pipeline-to-pipeline communication to redirect the traffic to different pipelines inside the pipelines.yml

Do you have any hints which approach is better in terms of ressource consumption?

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.