I've decided to move from using flow/output configuration on a per application basis to clusterflow/clusteroutput configuration on a per cluster basis. The second being a more infrastructure oriented approach. What are your preferences and why?

Imo it totally depends on the application workload. Such as how much it's logging and how often. what is the application architecture? Multi namespaced or all in one? What kind of logs are relevant and where are they going? How are they being processed and organized on the other side? When building a cluster logging strategy these are some of the big questions I like to ask. If you want all namespaces minus a few - cluster scope. If you want just one or two namespaces on the entire cluster then namespaced is the way to go.