diff --git a/conftool-data/node/eqiad.yaml b/conftool-data/node/eqiad.yaml
index ba9383e00f..6714f42cfe 100644
--- a/conftool-data/node/eqiad.yaml
+++ b/conftool-data/node/eqiad.yaml
@@ -305,6 +305,6 @@ eqiad:
     wdqs1002.eqiad.wmnet: [wdqs]
     wdqs1003.eqiad.wmnet: [wdqs]
   logstash:
-    logstash1001.eqiad.wmnet: [kibana]
-    logstash1002.eqiad.wmnet: [kibana]
-    logstash1003.eqiad.wmnet: [kibana]
+    logstash1001.eqiad.wmnet: [kibana, logstash]
+    logstash1002.eqiad.wmnet: [kibana, logstash]
+    logstash1003.eqiad.wmnet: [kibana, logstash]
diff --git a/conftool-data/service/services.yaml b/conftool-data/service/services.yaml
index aee6bcd3af..44464c909f 100644
--- a/conftool-data/service/services.yaml
+++ b/conftool-data/service/services.yaml
@@ -218,3 +218,31 @@ logstash:
     default_values:
       pooled: 'no'
       weight: 10
+  logstash-log4j:
+    port: 4560
+    datacenters:
+    - eqiad
+    default_values:
+      pooled: 'no'
+      weight: 10
+  logstash-gelf:  #UDP ??
+    port: 12201
:...skipping...
diff --git a/conftool-data/node/eqiad.yaml b/conftool-data/node/eqiad.yaml
index ba9383e00f..6714f42cfe 100644
--- a/conftool-data/node/eqiad.yaml
+++ b/conftool-data/node/eqiad.yaml
@@ -305,6 +305,6 @@ eqiad:
     wdqs1002.eqiad.wmnet: [wdqs]
     wdqs1003.eqiad.wmnet: [wdqs]
   logstash:
-    logstash1001.eqiad.wmnet: [kibana]
-    logstash1002.eqiad.wmnet: [kibana]
-    logstash1003.eqiad.wmnet: [kibana]
+    logstash1001.eqiad.wmnet: [kibana, logstash]
+    logstash1002.eqiad.wmnet: [kibana, logstash]
+    logstash1003.eqiad.wmnet: [kibana, logstash]
diff --git a/conftool-data/service/services.yaml b/conftool-data/service/services.yaml
index aee6bcd3af..44464c909f 100644
--- a/conftool-data/service/services.yaml
+++ b/conftool-data/service/services.yaml
@@ -218,3 +218,31 @@ logstash:
     default_values:
       pooled: 'no'
       weight: 10
+  logstash-log4j:
+    port: 4560
+    datacenters:
+    - eqiad
+    default_values:
+      pooled: 'no'
+      weight: 10
+  logstash-gelf:  #UDP ??
+    port: 12201
+    datacenters:
+    - eqiad
+    default_values:
+      pooled: 'no'
+      weight: 10
+  logstash-udp:  #UDP ??
+    port: 11514
+    datacenters:
+    - eqiad
+    default_values:
+      pooled: 'no'
+      weight: 10
+  logstash-tcp:
+    port: 11514
+    datacenters:
+    - eqiad
+    default_values:
+      pooled: 'no'
+      weight: 10
diff --git a/hieradata/common/lvs/configuration.yaml b/hieradata/common/lvs/configuration.yaml
index 7e1919c442..264048f1fb 100644
--- a/hieradata/common/lvs/configuration.yaml
+++ b/hieradata/common/lvs/configuration.yaml
@@ -140,6 +140,8 @@ lvs::configuration::lvs_service_ips:
   trendingedits: &ip_block035
     eqiad: 10.2.2.9
     codfw: 10.2.1.9
+  logstash: &ip_block036
+    eqiad: 10.2.2.36
 lvs::configuration::lvs_services:
   text:
     description: "Main wiki platform LVS service, text.%{::site}.wikimedia.org (Varnish)"
@@ -1249,3 +1251,81 @@ lvs::configuration::lvs_services:
           hostname: trendingedits.svc.eqiad.wmnet
         codfw:
           hostname: trendingedits.svc.codfw.wmnet
+  logstash-log4j:
+    description: Logstash ingestion log4j
+    class: low-traffic
+    sites:
+    - eqiad
+    ip: *ip_block036
+    port: 4560
+    bgp: 'yes'
+    depool-threshold: '.5'
+    scheduler: sh
+    monitors:
+      IdleConnection:
+        timeout-clean-reconnect: 3
+        max-delay: 300
+    conftool:
+      cluster: logstash
+      service: logstash
+    icinga:
+      check_command: "check_tcp_ip!logstash.svc.%{::site}.wmnet!4560"
+      sites:
+        eqiad:
+          hostname: logstash.svc.eqiad.wmnet
+  logstash-gelf:
+    description: Logstash ingestion gelf
+    class: low-traffic
+    sites:
+    - eqiad
+    ip: *ip_block036
+    protocol: udp
+    port: 12201
+    bgp: 'yes'
+    depool-threshold: '.5'
+    monitors:
+      IdleConnection:
+        timeout-clean-reconnect: 3
+        max-delay: 300
+    conftool:
+      cluster: logstash
+      service: logstash
+  logstash-udp:
+    description: Logstash ingestion standard udp
+    class: low-traffic
+    sites:
+    - eqiad
+    ip: *ip_block036
+    protocol: udp
+    port: 11514
+    bgp: 'yes'
+    depool-threshold: '.5'
+    monitors:
+      IdleConnection:
+        timeout-clean-reconnect: 3
+        max-delay: 300
+    conftool:
+      cluster: logstash
+      service: logstash
+  logstash-tcp:
+    description: Logstash ingestion standard tcp
+    class: low-traffic
+    sites:
+    - eqiad
+    ip: *ip_block036
+    port: 11514
+    bgp: 'yes'
+    depool-threshold: '.5'
+    scheduler: sh
+    monitors:
+      IdleConnection:
+        timeout-clean-reconnect: 3
+        max-delay: 300
+    conftool:
+      cluster: logstash
+      service: logstash
+    icinga:
+      check_command: "check_tcp_ip!logstash.svc.%{::site}.wmnet!11514"
+      sites:
+        eqiad:
+          hostname: logstash.svc.eqiad.wmnet
diff --git a/hieradata/role/eqiad/kibana.yaml b/hieradata/role/eqiad/kibana.yaml
index 42834ad5cb..8ca61c95e3 100644
--- a/hieradata/role/eqiad/kibana.yaml
+++ b/hieradata/role/eqiad/kibana.yaml
@@ -1,2 +1,3 @@
 lvs::realserver::realserver_ips:
     - '10.2.2.33' # kibana.svc.eqiad.wmnet
+    - '10.2.2.36' # logstash.svc.eqiad.wmnet
diff --git a/modules/role/manifests/lvs/balancer.pp b/modules/role/manifests/lvs/balancer.pp
index 1742d15908..1c4cb2e824 100644
--- a/modules/role/manifests/lvs/balancer.pp
+++ b/modules/role/manifests/lvs/balancer.pp
@@ -49,6 +49,7 @@ class role::lvs::balancer {
             $sip['eventstreams'][$::site],
             $sip['pdfrender'][$::site],
             $sip['trendingedits'][$::site],
+            $sip['logstash'][$::site],
             ],
 
         # codfw (should mirror eqiad above, eventually, and become merged with it via regex