diff --git a/logstash/configmap.yaml b/logstash/configmap.yaml
index 9a4d84e..5f43ea8 100644
--- a/logstash/configmap.yaml
+++ b/logstash/configmap.yaml
@@ -4,6 +4,10 @@ metadata:
   name: logstash-config
   namespace: app-notifications
 data:
+  logstash.yml: |
+    http.host: "0.0.0.0"
+    xpack.monitoring.enabled: false
+
   logstash.conf: |
     input {
       beats {
@@ -14,5 +18,11 @@ data:
          if [level] == "DEBUG" { drop {} }
       }
     output {
-      stdout { codec => json }  # for testing
+      elasticsearch {
+        hosts => ["http://elasticsearch:9200"]
+        user => "elastic"
+        password => "${ELASTIC_PASSWORD}"
+        ssl_verification_mode => none
+        index => "app-notifications-%{+YYYY.MM.dd}"
+      }
     }
diff --git a/logstash/deployment.yaml b/logstash/deployment.yaml
index d448135..22b18bc 100644
--- a/logstash/deployment.yaml
+++ b/logstash/deployment.yaml
@@ -16,9 +16,18 @@ spec:
       containers:
       - name: logstash
         image: docker.elastic.co/logstash/logstash:8.12.1
+        env:
+          - name: ELASTIC_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: elastic-credentials
+                key: ELASTIC_PASSWORD
         ports:
         - containerPort: 5044
         volumeMounts:
+        - name: logstash-config
+          mountPath: /usr/share/logstash/config/logstash.yml
+          subPath: logstash.yml
         - name: logstash-config
           mountPath: /usr/share/logstash/pipeline/logstash.conf
           subPath: logstash.conf