diff --git a/dev-upgrade/elastic/logstash-ngx.yaml b/dev-upgrade/elastic/logstash-ngx.yaml
index 3e586a5..6a3771f 100644
--- a/dev-upgrade/elastic/logstash-ngx.yaml
+++ b/dev-upgrade/elastic/logstash-ngx.yaml
@@ -5,8 +5,12 @@ metadata:
 data:
   logstash.conf: |-
     input {
-      beats {
-        port => 5044
+      kafka{
+        bootstrap_servers => "10.2.0.12:30002,10.2.0.12:30003,10.2.0.12:30004"
+        topics => ["nginx-dev"]
+        group_id => "logstash-ngx"
+        auto_offset_reset => "earliest"
+        codec => json
       }
     }
 
@@ -16,8 +20,8 @@ data:
         target => "@timestamp"
       }
       mutate {
-        add_field => { "env" => "%{[tags][0]}" }
-        remove_field => [ "tags" ]
+        add_field => { "env" => "%{[fields][env]}" }
+        remove_field => [ "fields" ]
       }
     }