diff --git a/puppet/manifests/filebeat.pp b/puppet/manifests/filebeat.pp
index dfef9bce872c5f67403022e8bd35439a73e7de81..b813dcc6b59a554b88fe07da5f55d1e1def769c7 100644
--- a/puppet/manifests/filebeat.pp
+++ b/puppet/manifests/filebeat.pp
@@ -51,17 +51,20 @@ class oci::filebeat(
 
   if $filebeat_enable {
 
-
     $filebeat_default_inputs = [
         {
           name => 'system',
           paths => [
-            '/var/log/zabbix/*.log*',
-            '/var/log/*.log*',
+            '/var/log/auth.log',
+            '/var/log/daemon.log',
+            '/var/log/mail.log',
+            '/var/log/syslog',
+            '/var/log/messages',
           ],
           tags => [
             'syslog',
             'system',
+            $cluster_name,
           ],
         },
       ]
@@ -141,29 +144,41 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
         fields_under_root => true,
         paths             => [ '/var/log/aodh/*.log*' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'aodh', 'openstack', ],
+        tags              => [ 'aodh', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/aodh.yml': ensure => 'absent', notify => Service['filebeat'] }
     }
 
     if $log_apache2{
-      filebeat::input { 'apache2':
+      filebeat::input { 'apache2-access':
+        fields_under_root => true,
+        paths             => [ '/var/log/apache2/*access.log' ],
+        fields            => { backend => $machine_role, },
+        tags              => [ 'apache2', 'access', $cluster_name, ],
+      }
+      filebeat::input { 'apache2-error':
         fields_under_root => true,
-        paths             => [ '/var/log/apache2/*.log*' ],
+        paths             => [ '/var/log/apache2/*error.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'apache2', ],
+        tags              => [ 'apache2', 'error', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/apache2.yml': ensure => 'absent', notify => Service['filebeat'] }
     }
 
     if $log_barbican{
-      filebeat::input { 'barbican':
+      filebeat::input { 'barbican-wsgi-api':
+        fields_under_root => true,
+        paths             => [ '/var/log/barbican/barbican-wsgi-api.log', '/var/log/barbican/barbican-manage.log' ],
+        fields            => { backend => $machine_role, },
+        tags              => [ 'barbican', 'openstack', 'oslo', $cluster_name, ],
+      }
+      filebeat::input { 'barbican-api':
         fields_under_root => true,
-        paths             => [ '/var/log/barbican/*.log*' ],
+        paths             => [ '/var/log/barbican/barbican-api.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'barbican', 'openstack', ],
+        tags              => [ 'barbican', 'openstack', 'uwsgi', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/barbican.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -172,9 +187,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_frr{
       filebeat::input { 'frr':
         fields_under_root => true,
-        paths             => [ '/var/log/frr/*.log*' ],
+        paths             => [ '/var/log/frr/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'frr', 'system', ],
+        tags              => [ 'frr', 'syslog', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/frr.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -182,17 +197,17 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
 
     filebeat::input { 'chrony':
       fields_under_root => true,
-      paths             => [ '/var/log/chrony/*.log*' ],
+      paths             => [ '/var/log/chrony/*.log' ],
       fields            => { backend => $machine_role, },
-      tags              => [ 'chrony', 'ntp', 'system', ],
+      tags              => [ 'chrony', 'ntp', $cluster_name, ],
     }
 
     if $log_ceilometer{
       filebeat::input { 'ceilometer':
         fields_under_root => true,
-        paths             => [ '/var/log/ceilometer/*.log*' ],
+        paths             => [ '/var/log/ceilometer/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'ceilometer', 'openstack', ],
+        tags              => [ 'ceilometer', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/ceilometer.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -201,9 +216,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_ceph{
       filebeat::input { 'ceph':
         fields_under_root => true,
-        paths             => [ '/var/log/ceph/*.log*' ],
+        paths             => [ '/var/log/ceph/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'ceph', ],
+        tags              => [ 'ceph', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/ceph.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -212,9 +227,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_cinder{
       filebeat::input { 'cinder':
         fields_under_root => true,
-        paths             => [ '/var/log/cinder/*.log*' ],
+        paths             => [ '/var/log/cinder/cinder-volume.log', '/var/log/cinder/cinder-backup.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'cinder', 'openstack', ],
+        tags              => [ 'cinder', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/cinder.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -223,9 +238,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_cloudkitty{
       filebeat::input { 'cloudkitty':
         fields_under_root => true,
-        paths             => [ '/var/log/cloudkitty/*.log*' ],
+        paths             => [ '/var/log/cloudkitty/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'cloudkitty', 'openstack', ],
+        tags              => [ 'cloudkitty', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/cloudkitty.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -234,9 +249,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_corosync{
       filebeat::input { 'corosync':
         fields_under_root => true,
-        paths             => [ '/var/log/corosync/*.log*' ],
+        paths             => [ '/var/log/corosync/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'corosync', 'system', ],
+        tags              => [ 'corosync', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/corosync.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -245,9 +260,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_designate{
       filebeat::input { 'designate':
         fields_under_root => true,
-        paths             => [ '/var/log/designate/*.log*' ],
+        paths             => [ '/var/log/designate/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'designate', 'openstack', ],
+        tags              => [ 'designate', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/designate.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -256,9 +271,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_etcd{
       filebeat::input { 'etcd':
         fields_under_root => true,
-        paths             => [ '/var/log/etcd/*.log*' ],
+        paths             => [ '/var/log/etcd/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'etcd', 'system', ],
+        tags              => [ 'etcd', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/etcd.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -267,9 +282,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_haproxy{
       filebeat::input { 'haproxy':
         fields_under_root => true,
-        paths             => [ '/var/log/haproxy.log*' ],
+        paths             => [ '/var/log/haproxy.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'haproxy', 'system', ],
+        tags              => [ 'haproxy', 'syslog', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/haproxy.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -278,20 +293,26 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_horizon{
       filebeat::input { 'horizon':
         fields_under_root => true,
-        paths             => ['/var/log/horizon/*.log*', '/var/log/openstack-dashboard/*.log*'],
+        paths             => ['/var/log/horizon/*.log', '/var/log/openstack-dashboard/*.log'],
         fields            => { backend => $machine_role, },
-        tags              => [ 'horizon', 'openstack', ],
+        tags              => [ 'horizon', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/horizon.yml': ensure => 'absent', notify => Service['filebeat'] }
     }
 
     if $log_glance{
-      filebeat::input { 'glance':
+      filebeat::input { 'glance-api':
         fields_under_root => true,
-        paths             => [ '/var/log/glance/*.log*' ],
+        paths             => [ '/var/log/glance/api.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'glance', 'openstack', ],
+        tags              => [ 'glance', 'openstack', 'oslo', $cluster_name, ],
+      }
+      filebeat::input { 'glance-api-uwsgi':
+        fields_under_root => true,
+        paths             => [ '/var/log/glance/glance-api.log' ],
+        fields            => { backend => $machine_role, },
+        tags              => [ 'glance', 'openstack', 'uwsgi', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/glance.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -300,9 +321,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_gnocchi{
       filebeat::input { 'gnocchi':
         fields_under_root => true,
-        paths             => [ '/var/log/gnocchi/*.log*' ],
+        paths             => [ '/var/log/gnocchi/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'gnocchi', 'openstack', ],
+        tags              => [ 'gnocchi', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/gnocchi.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -311,9 +332,15 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_heat{
       filebeat::input { 'heat':
         fields_under_root => true,
-        paths             => [ '/var/log/heat/*.log*' ],
+        paths             => [ '/var/log/heat/heat-api-cfn.log', '/var/log/heat/heat-engine.log', '/var/log/heat/heat-purge_deleted.log', '/var/log/heat/heat-wsgi-api-cfn.log' ],
+        fields            => { backend => $machine_role, },
+        tags              => [ 'heat', 'openstack', 'oslo', $cluster_name, ],
+      }
+      filebeat::input { 'heat-api':
+        fields_under_root => true,
+        paths             => [ '/var/log/heat/heat-api.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'heat', 'openstack', ],
+        tags              => [ 'heat', 'openstack', 'uwsgi', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/heat.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -322,9 +349,15 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_keystone{
       filebeat::input { 'keystone':
         fields_under_root => true,
-        paths             => [ '/var/log/keystone/*.log*' ],
+        paths             => [ '/var/log/keystone/keystone-admin.log', '/var/log/keystone/keystone-public.log', '/var/log/keystone/keystone-wsgi-public.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'keystone', 'openstack', ],
+        tags              => [ 'keystone', 'openstack', 'oslo', $cluster_name, ],
+      }
+      filebeat::input { 'keystone-api':
+        fields_under_root => true,
+        paths             => [ '/var/log/keystone/keystone.log' ],
+        fields            => { backend => $machine_role, },
+        tags              => [ 'keystone', 'openstack', 'uwsgi', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/keystone.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -333,9 +366,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_memcached{
       filebeat::input { 'memcached':
         fields_under_root => true,
-        paths             => [ '/var/log/memcached/*.log*' ],
+        paths             => [ '/var/log/memcached/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'memcached', 'system', ],
+        tags              => [ 'memcached', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/memcached.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -344,9 +377,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_magnum{
       filebeat::input { 'magnum':
         fields_under_root => true,
-        paths             => [ '/var/log/magnum/*.log*' ],
+        paths             => [ '/var/log/magnum/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'magnum', 'openstack', ],
+        tags              => [ 'magnum', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/magnum.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -355,9 +388,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_mysql{
       filebeat::input { 'mysql':
         fields_under_root => true,
-        paths             => [ '/var/log/mysql/*.log*' ],
+        paths             => [ '/var/log/mysql/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'mysql', 'system', ],
+        tags              => [ 'mysql', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/mysql.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -366,9 +399,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_neutron{
       filebeat::input { 'neutron':
         fields_under_root => true,
-        paths             => [ '/var/log/neutron/*.log*' ],
+        paths             => [ '/var/log/neutron/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'neutron', 'openstack', ],
+        tags              => [ 'neutron', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/neutron.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -377,9 +410,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_nova{
       filebeat::input { 'nova':
         fields_under_root => true,
-        paths             => [ '/var/log/nova/*.log*' ],
+        paths             => [ '/var/log/nova/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'nova', 'openstack', ],
+        tags              => [ 'nova', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/nova.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -388,9 +421,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_octavia{
       filebeat::input { 'octavia':
         fields_under_root => true,
-        paths             => [ '/var/log/octavia/*.log*' ],
+        paths             => [ '/var/log/octavia/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'octavia', 'openstack', ],
+        tags              => [ 'octavia', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/octavia.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -399,9 +432,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_openvswitch{
       filebeat::input { 'openvswitch':
         fields_under_root => true,
-        paths             => [ '/var/log/openvswitch/*.log*' ],
+        paths             => [ '/var/log/openvswitch/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'openvswitch', 'system', ],
+        tags              => [ 'openvswitch', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/openvswitch.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -410,9 +443,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_panko{
       filebeat::input { 'panko':
         fields_under_root => true,
-        paths             => [ '/var/log/panko/*.log*' ],
+        paths             => [ '/var/log/panko/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'panko', 'openstack', ],
+        tags              => [ 'panko', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/panko.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -421,9 +454,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_pacemaker{
       filebeat::input { 'pacemaker':
         fields_under_root => true,
-        paths             => [ '/var/log/pacemaker/*.log*' ],
+        paths             => [ '/var/log/pacemaker/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'pacemaker', 'system', ],
+        tags              => [ 'pacemaker', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/pacemaker.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -432,9 +465,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_placement{
       filebeat::input { 'placement':
         fields_under_root => true,
-        paths             => [ '/var/log/placement/*.log*' ],
+        paths             => [ '/var/log/placement/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'placement', 'openstack', ],
+        tags              => [ 'placement', 'openstack', 'oslo', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/placement.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -443,9 +476,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_rabbitmq{
       filebeat::input { 'rabbitmq':
         fields_under_root => true,
-        paths             => [ '/var/log/rabbitmq/*.log*' ],
+        paths             => [ '/var/log/rabbitmq/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'rabbitmq', 'system', ],
+        tags              => [ 'rabbitmq', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/rabbitmq.yml': ensure => 'absent', notify => Service['filebeat'] }
@@ -454,10 +487,16 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_swiftproxy{
       filebeat::input { 'swiftproxy':
         fields_under_root => true,
-        paths             => ['/var/log/swift/swift-proxy*.log*', '/var/log/swift/proxy*.log*'],
+        paths             => [ '/var/log/swift/proxy.log' ],
         fields            => { backend => $machine_role, },
         tags              => [ 'swift', 'proxy', 'openstack', 'syslog', $cluster_name, ],
       }
+      filebeat::input { 'swiftproxy-uwsgi':
+        fields_under_root => true,
+        paths             => [ '/var/log/swift/swift-proxy.log' ],
+        fields            => { backend => $machine_role, },
+        tags              => [ 'swift', 'proxy', 'openstack', 'uwsgi', $cluster_name, ],
+      }
     }else{
       file { '/etc/filebeat/conf.d/swiftproxy.yml': ensure => 'absent', notify => Service['filebeat'] }
     }
@@ -465,10 +504,16 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_swiftaccount{
       filebeat::input { 'swiftaccount':
         fields_under_root => true,
-        paths             => ['/var/log/swift/swift-account*.log*', '/var/log/swift/account*.log*'],
+        paths             => [ '/var/log/swift/account.log' ],
         fields            => { backend => $machine_role, },
         tags              => [ 'swift', 'account', 'openstack', 'syslog', $cluster_name, ],
       }
+      filebeat::input { 'swiftaccount-uwsgi':
+        fields_under_root => true,
+        paths             => [ '/var/log/swift/swift-account.log' ],
+        fields            => { backend => $machine_role, },
+        tags              => [ 'swift', 'account', 'openstack', 'uwsgi', $cluster_name, ],
+      }
     }else{
       file { '/etc/filebeat/conf.d/swiftaccount.yml': ensure => 'absent', notify => Service['filebeat'] }
     }
@@ -476,10 +521,16 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_swiftcontainer{
       filebeat::input { 'swiftcontainer':
         fields_under_root => true,
-        paths             => ['/var/log/swift/swift-container*.log*', '/var/log/swift/container*.log*'],
+        paths             => [ '/var/log/swift/container.log' ],
         fields            => { backend => $machine_role, },
         tags              => [ 'swift', 'container', 'openstack', 'syslog', $cluster_name, ],
       }
+      filebeat::input { 'swiftcontainer-uwsgi':
+        fields_under_root => true,
+        paths             => [ '/var/log/swift/swift-container.log' ],
+        fields            => { backend => $machine_role, },
+        tags              => [ 'swift', 'container', 'openstack', 'uwsgi', $cluster_name, ],
+      }
     }else{
       file { '/etc/filebeat/conf.d/swiftcontainer.yml': ensure => 'absent', notify => Service['filebeat'] }
     }
@@ -487,7 +538,7 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_swiftobject{
       filebeat::input { 'swiftobject':
         fields_under_root => true,
-        paths             => [ '/var/log/swift/object*.log*' ],
+        paths             => [ '/var/log/swift/object.log' ],
         fields            => { backend => $machine_role, },
         tags              => [ 'swift', 'object', 'openstack', 'syslog', $cluster_name, ],
       }
@@ -498,9 +549,9 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
     if $log_zookeeper{
       filebeat::input { 'zookeeper':
         fields_under_root => true,
-        paths             => [ '/var/log/zookeeper/*.log*' ],
+        paths             => [ '/var/log/zookeeper/*.log' ],
         fields            => { backend => $machine_role, },
-        tags              => [ 'zookeeper', 'system', ],
+        tags              => [ 'zookeeper', $cluster_name, ],
       }
     }else{
       file { '/etc/filebeat/conf.d/zookeeper.yml': ensure => 'absent', notify => Service['filebeat'] }