1st logstash config