let's curate the ES logstash log

what do you mean by overridable? it merges with the pillar so you can override it there.