output: logstash: enabled: true hosts: - $ELK_HOST:$ELK_PORT filebeat: prospectors: - paths: - /var/log/mail/mail.log document_type: syslog