Yes, my logstash branch https://github.com/dannycoates/picl-idp/blob/logstash/.awsboxen.json does this. I'll be merging this branch with that one for the final draft.