Ingestion health with one collector

Hello ,

I have a question about our specific architecture:
we currently have a single collector (with several forwarders)  that aggregates logs from many devices and customers (for example, multiple Fortigate firewalls from different tenants).

With ingestion health metrics / Cloud Monitoring, I can see when the collector itself stops ingesting logs, but I don’t see how to know which exact firewall or customer pipeline has gone silent if the collector is still receiving logs from other sources.

My questions are:

• In a single-collector design, is there a recommended way to make ingestion alerts more granular (per customer / per device)? For example, using different ingestion_source labels or another best practice?

Thanks a lot for any guidance or design recommendations on this.