diff --git a/roles/elasticstack/files/11-log4j-input.conf b/roles/elasticstack/files/11-log4j-input.conf
new file mode 100644
index 0000000..2d11577
--- /dev/null
+++ b/roles/elasticstack/files/11-log4j-input.conf
@@ -0,0 +1,15 @@
+input {
+  log4j {
+    port => 4560
+    type => "log4j"
+  }
+}
+
+filter {
+  mutate {
+    rename => {"priority" => "level"}
+    rename => {"bundle.id" => "bundle_id"}
+    rename => {"bundle.name" => "bundle_name"}
+    rename => {"bundle.version" => "bundle_version"}
+  }
+}