I have 10 remote sites that I need to backhaul the logs to a central site for processing. I was going to have logstash at each of the remote sites and use lumberjack to forward the logs to the central site. The question I have is that I need to keep each site's logs isolated from one another.
Has anyone seen a configuration for accomplishing this type of thing ? My brute force method is to just stand up 10 logstash instances at the central site and do a 1:1 mapping, but if I can be more efficient I would certainly welcome the feedback.