Created 4 applications under different projects with labels below:

Note: Provide labels for project-qa-1 and project-qa-2
"labels":

{                     "run": "centos-logtest-qa",                     "test": "centos-logtest-qa"                 }

and provide set of labels to project-dev-1 and project-dev-2

"labels":

{                     "run": "centos-logtest-dev",                     "test": "centos-logtest-dev"                 }

Below is the CLF created to forward logs for label selector

apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogForwarder"
metadata:
    name: "instance"
spec:
    pipelines:
     - inputRefs: [ myLogs ]
        outputRefs: [ default ]
    inputs:
       - name: myLogs
          application:
          selector:
              matchLabels:
                  run: centos-logtest-qa
                  test: centos-logtest-qa

 

Logs are not present for these two namespaces (project-dev-1 and project-dev-2) under kibana though.

CLO and EO version:

NAME                              DISPLAY                            VERSION    REPLACES   PHASE

cluster-logging.5.1.0-74          Cluster Logging                    5.1.0-74              Succeeded

elasticsearch-operator.5.1.0-95   OpenShift Elasticsearch Operator   5.1.0-95              Succeeded

Able to see logs for project-dev-1 and project-dev-2 under ES as well.