breaking up logstash config