diff --git a/puppet/manifests/filebeat.pp b/puppet/manifests/filebeat.pp
index b813dcc6b59a554b88fe07da5f55d1e1def769c7..4ba783d85bed62a1333d8144717f879e3386cd92 100644
--- a/puppet/manifests/filebeat.pp
+++ b/puppet/manifests/filebeat.pp
@@ -51,24 +51,6 @@ class oci::filebeat(
 
   if $filebeat_enable {
 
-    $filebeat_default_inputs = [
-        {
-          name => 'system',
-          paths => [
-            '/var/log/auth.log',
-            '/var/log/daemon.log',
-            '/var/log/mail.log',
-            '/var/log/syslog',
-            '/var/log/messages',
-          ],
-          tags => [
-            'syslog',
-            'system',
-            $cluster_name,
-          ],
-        },
-      ]
-
     $filebeat_repo_key = '-----BEGIN PGP PUBLIC KEY BLOCK-----
 Version: GnuPG v2.0.14 (GNU/Linux)
 
@@ -106,7 +88,7 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
       location => $filebeat_repo,
       release  => 'stable',
       key      => {
-	id      => '46095ACC8548582C1A2699A9D27D666CD88E42B4',
+        id      => '46095ACC8548582C1A2699A9D27D666CD88E42B4',
         ensure  => 'present',
         content => $filebeat_repo_key,
       }
@@ -139,6 +121,13 @@ qPDlGRlOgVTd9xUfHFkzB52c70E=
       require => Apt::Source['filebeat'],
     }
 
+    filebeat::input { 'system':
+      fields_under_root => true,
+      paths             => [ '/var/log/auth.log', '/var/log/daemon.log', '/var/log/mail.log', '/var/log/syslog', '/var/log/messages', ],
+      fields            => { backend => $machine_role, },
+      tags              => [ 'syslog', 'system', $cluster_name, ],
+    }
+
     if $log_aodh{
       filebeat::input { 'aodh':
         fields_under_root => true,