Client own words:

// 
we are using OpenShift Logging 5.6.1 with elasticsearch in all of our Clusters.
Due to a high log volume of a specific project, the elasticsearch instance in one cluster gets overloaded and storage usage increases quite much.

We need a way to drop logs from a specific namespace.
How can we achieve this?

• Configuration Option in OpenShift Logging to blacklist the collection from logs of a specific application namespace
• Needed to blackhole logging from a namespace in case of problems that generate a ridiculous amount of logs that fill up the elastic search storage
• Configuration Option in Openshift Logging which can be given a label selector. All namespaces and or pods that have this label attached will be ignored by openshift logging
• Create namespace with custom label. Enter custom label in OpenShift Logging blackhole config. Check if logs still get picked up by openshift logging
• n/a
• OpenShift Logging
• We would assist in testing.

 **