Separate indexes for each kubernetes namespace

If the events have a field on them that contains the namespace name then you can use a reference to that in the index option for the elasticsearch output

index => "%{[fieldContainingNamespaceName]}"

If you have 50 namespaces then you are going to end up with a large number of shards, which can impact performance in elasticsearch. You may want to reduce the number of shards per index.

2 Likes