We use fluentd-hec to send openshift container logs to Splunk Enterprise and this works nicely. However fluentd-hec is not supported anymore and Splunk offers an alternative, their own distribution of the Opentelemetry collector.
we configured fluentd-hec to send the logs from tenant namespaces to Splunk indexes owned by the tenant itself. For this, every tenant has it own spunk_hec output definition with its own hec-token and index configured.
I want to configure the same functionality in the Opentelemetry collector. However it is not clear to me how to realize this.
I understand that;
Each hec token requires its own exporter definition. Same as in fluentd.
Can I make one pipeline with a router that selects the exporter to use based on namespace. Or do I have to create a pipeline for every tenant and select the namespace log files as source in the receiver.