The overhead of a separate pipeline is relatively low, but non-zero.
- Depending on your queue configuration (in-memory or persisted), multiple pipelines can mean more data structures in memory or on disk. If your pipelines are consistently able to "keep up" with inbound load, this should be negligible.
- if one pipeline is significantly more complex than the others, you may need to manually tune the number of workers per pipeline to reduce resource contention.
If they are drastically different though, I would advise separate output from your applications leading to separate pipelines. The cognitive overhead of writing a single pipeline to do two drastically different things increases the likelihood of mistakes, and in my book that far outweighs any marginal performance difference.
I would also advise starting with the Dissect filter instead of Grok, and only using Grok where your input is too complex for Dissect. It is significantly easier to get started with from a development perspective, the patterns are simpler to maintain, and as a bonus it often ends up being significantly less CPU-intensive.