Currently there is no way to set the keepalive in the fluent forward config when forwarding logs to external fluentd.
By default keepalive is set to false, which means a new socket is created for every chunk sent. I feel that this is inefficient and would prefer to use the existing socket connection to send logs.
Especially since with the keepalive set to false, fluentd doesn't seem to close the open sockets, even if they're not being used anymore. They only get closed when the eventual network tcp timeout is reached.
Enable keepalive by default.
We have tested this using the legacy method of using the config map to configure forwarding and it works the way we expect it to.