Multi tenant support

[vogtph]

It would be nice if tenants (namespace owners) have more control about formatting and routing their log files.
Use case: Tenants can own several name spaces and have their own Splunk index and hec token. In fluentd-hec this was easily configured by creating an output per index/hec token pair and using a router that relabeled events depending on the name space name.

In the helm charts I do not see support for using multiple hec tokens or the possibility to create an output for each index/hec token combination.

Is there a change this will be supported in the near future?

[skirven4]

+1. I have a user that has two Splunk instances ("dev" and "qa"). And while they may have one k8s cluster, they may want to choose to send the data to their Dev or QA instance accordingly. I know we could send all data to one, and then fork the data, the users don't want to do that. Maybe the other option might be to send to a HEC Server (vs the Stand Alone server) then forward to the right server from there?

[rsreese]

We are looking for the same feature per #1170