We are planning a Private Cloud implementation of Java applications using a Cloud Vendor. We use Splunk Forwarders on our existing static servers. I have started to research different ways to stream the logs to Splunk once we starting using the Paas Solution. The suggestions I have read are to stream the logs to syslog and use a Data Sink to push the logs to the Splunk Indexers. Then we would need to set up a new UDP listener on each of our Indexers. This seems like a really complicated way to do this because we would have to set up a UDP port for each sourcetype for each index we want to index.
The other thought was to use a custom log4j appender to stream the logs from the container to the Splunk Indexers. This seems like a better way, but it doesn't look like you set up the logs to to separate the logs by index and sourcetype.
Is there an easier way to stream the logs into Splunk like the Splunk Forwarder provides?