How to Split Logs from a Pod into Different Outputs Based on JSON Key Values

[sass1997]

Hi everyone,

I’m looking for guidance or a recipe to split logs from a single pod into different outputs based on the value of a specific key in the log’s JSON schema.

Context:

• Our logs are structured in JSON format.
• We need to route logs dynamically to different outputs depending on the value of a particular key in the JSON.

Use Case:
The goal is to move logs with a specific tag (or key value) into a dedicated tenant in Loki, which has a shorter retention period compared to other logs. This allows us to optimize log storage and retention policies for specific types of logs.

Questions:

1. Is there an existing solution or configuration for this scenario?
2. Do you have an example Flow/ClusterFlow?

Any insights, examples, or documentation references would be greatly appreciated!

Thank you in advance for your help!