"logstash" should remain