Proposed title of this feature request

Allow namespace to be selected via namespace selector

What is the nature and description of the request?

This is similar to what was discussed in OBSDA-272.

Customers would like to forward logs based on namespace labels. This seems not to be possible at the moment. Customers are trying to forward log using filters like the following; however that will not work as a missing / unset label will result in a "false" result and the logs will not be dropped as expected:

# Will not work
  - name: application-filter
    type: drop 
    drop: 
      - test: 
        - field: .kubernetes.namespace_labels."splunk.com/include" 
          notMatches: "true"

So this RFE asks for the possibility to select inputs based on namespace labels, something like the following:

  inputs:
   - name: input-selection-splunk
     application:
       includes:
       - namespaceLabels: "splunk.com/include: true"

Why does the customer need this? (List the business requirements)

This allows end users or cluster administrators to dynamically include namespaces and forward based on namespace labels. This allows customers to optimize which namespaces are sent to which logging solution without needing to reconfigure the ClusterLogForwarder, resulting in a quicker way to optimise costs.

List any affected packages or components.

ClsuterLogForwarder

Vector