<p>Do you know of any gotcha's or requirements that would not allow using a single ES/kibana as a target for fluentd in multiple k8 clusters?</p>

<p>We are engineering rolling out a new kubernetes model.  I have requirements to run multiple kubernetes clusters, lets say 4-6.  Even though the workload is split in multiple k8 clusters, I do not have a requirement to split the logging and believe it would be easier to find the logs for pods in all clusters in a centralized location.  Also less maintenance for kibana/elasticsearch.</p>

<p>Using EFK for Kubernetes, can I point Fluentd from multiple k8 clusters at a single ElasticSearch/Kibana?  I don't think I'm the first one with this thought however I haven't been able to find any discussion of doing this.  Found lots of discussions of setting up efk but all that I have found only discuss a single k8 to its own elasticsearch/kibana.</p>

<p>Has anyone else gone down the path of using a single es/kibana to service logs from multiple kubernetes clusters?  We'll plunge ahead with testing it out but seeing if anyone else has already gone down this road.</p>

Chad Ernst
<p>I dont think you should create an elastic instance for each kubernetes cluster, you can run a main elastic instance and index it all logs.</p>

<p>But even if you don`t have an elastic instance for each kubernetes client, i think you sohuld have a drp, so lets says instead moving your logs of all pods to elastic directly, maybe move it to kafka, and then split it to two elastic clusters.</p>

<p>Also it is very depend on the use case, if every kubernetes cluster is on different regions, and you need the pod`s logs in low latency (&lt;1s), so maybe one elastic instance is not the right answer.</p>
