more work on logstash