This message was deleted.

Imo it totally depends on the application workload. Such as how much it's logging and how often. what is the application architecture? Multi namespaced or all in one? What kind of logs are relevant and where are they going? How are they being processed and organized on the other side? When building a cluster logging strategy these are some of the big questions I like to ask. If you want all namespaces minus a few - cluster scope. If you want just one or two namespaces on the entire cluster then namespaced is the way to go.