add logstash group
another refactor / attempt