diff --git a/1systems/omo.nix b/1systems/omo.nix
index 7a36c57..a6a336f 100644
--- a/1systems/omo.nix
+++ b/1systems/omo.nix
@@ -54,9 +54,10 @@ in {
       ../2configs/omo-share.nix
       ../2configs/tinc/retiolum.nix
       ../2configs/logging/central-stats-server.nix
+      ../2configs/logging/central-logging-server.nix
       ../2configs/logging/central-stats-client.nix
+      ../2configs/logging/central-logging-client.nix
 
-      ../2configs/kapacitor.nix
       # ../2configs/torrent.nix
 
       # ../2configs/elchos/search.nix
diff --git a/2configs/logging/central-logging-client.nix b/2configs/logging/central-logging-client.nix
new file mode 100644
index 0000000..04d2de0
--- /dev/null
+++ b/2configs/logging/central-logging-client.nix
@@ -0,0 +1,32 @@
+{pkgs, buil, config, ...}:
+let
+  log-server = config.makefu.log-server;
+  log-port = 9200;
+in {
+  services.journalbeat = {
+    enable = true;
+    # TODO: filter for certain journal fields, not all
+    extraConfig = ''
+      journalbeat:
+        name: logs-${config.krebs.build.host.name}
+        seek_position: cursor
+        cursor_seek_fallback: tail
+        write_cursor_state: true
+        cursor_flush_period: 5s
+        clean_field_names: true
+        convert_to_numbers: false
+        move_metadata_to_field: journal
+        default_type: journal
+      output.elasticsearch:
+        enabled: true
+        hosts: ["${log-server}:${builtins.toString log-port}"]
+        template.enabled: false
+      #output.console:
+      #  enabled: true
+      logging.level: info
+      logging.to_syslog: true
+      logging.selectors: ["*"]
+
+    '';
+  };
+}
diff --git a/2configs/logging/central-logging-server.nix b/2configs/logging/central-logging-server.nix
new file mode 100644
index 0000000..e2cfe69
--- /dev/null
+++ b/2configs/logging/central-logging-server.nix
@@ -0,0 +1,23 @@
+{pkgs, config, ...}:
+
+with import <stockholm/lib>;
+let
+  es-port = 9200;
+  kibana-port = 5601;
+in {
+  services.elasticsearch = {
+    enable = true;
+    listenAddress = "0.0.0.0";
+    port = es-port;
+  };
+  services.kibana = {
+    enable = true;
+    listenAddress = "0.0.0.0";
+    port = kibana-port;
+  };
+
+  networking.firewall.extraCommands = ''
+    iptables -A INPUT -i retiolum -p tcp --dport ${toString es-port} -j ACCEPT
+    iptables -A INPUT -i retiolum -p tcp --dport ${toString es-port} -j ACCEPT
+  '';
+}
diff --git a/2configs/logging/central-stats-server.nix b/2configs/logging/central-stats-server.nix
index d4e73ab..8151d49 100644
--- a/2configs/logging/central-stats-server.nix
+++ b/2configs/logging/central-stats-server.nix
@@ -7,7 +7,7 @@ let
   grafana-port = 3000; # TODO nginx forward
 in {
   imports = [
-    ../../lass/3modules/kapacitor.nix
+    ../../../lass/3modules/kapacitor.nix
   ];
   services.grafana.enable = true;
   services.grafana.addr = "0.0.0.0";
@@ -45,11 +45,11 @@ in {
     alarms = {
       cpu_deadman = ''
         var data = batch
-            |query('''
+            |query(${"'''"}
                   SELECT mean("value") AS mean
                   FROM "collectd_db"."default"."cpu_value"
                   WHERE "type_instance" = 'idle' AND "type" = 'percent' fill(0)
-                ''')
+                ${"'''"})
                 .period(10m)
                 .every(1m)
                 .groupBy('host')
diff --git a/3modules/logging-config.nix b/3modules/logging-config.nix
index cd6924f..a77e32e 100644
--- a/3modules/logging-config.nix
+++ b/3modules/logging-config.nix
@@ -4,8 +4,13 @@ with import <stockholm/lib>;
 {
   options.makefu.stats-server = lib.mkOption {
     type = types.str;
-    default = "omo.retiolum";
+    default = "stats.makefu.r";
     description = "Central stats server (collectd)";
   };
+  options.makefu.log-server = lib.mkOption {
+    type = types.str;
+    default = "logs.makefu.r";
+    description = "Central logging server (logstash,elasticsearch)";
+  };
 }