Best way to structure sources and sinks in an agent + aggregator architecture

[flaviofcruz]

We are using an agent + aggregator architecture. The agent is ingesting data from file sources but also from kubernetes log sources. These logs are shipped into an aggregator but ultimately end up on different sinks.

Is there a recommendation for how one should setup the sources and sinks? Currently, we have two sinks in agent (for each source) but are using a single vector source in the aggregator with a route transform on top to separate the log streams. I would like to know if that's the most appropriate or whether the aggregator should also use two separate sources and then avoid the route transform.

[jszwedko]

I think either way works. I would start with modeling the config however you find most readable and then only optimize in if you find a need to.