diff --git a/elasticsearch/client.sls b/elasticsearch/client.sls
index f336cd3..4c8246e 100644
--- a/elasticsearch/client.sls
+++ b/elasticsearch/client.sls
@@ -8,6 +8,10 @@
   - user: root
   - group: root
 
+elasticsearch_client_packages:
+  pkg.installed:
+  - names: {{ client.pkgs }}
+
 {%- for index_name, index in client.get('index', {}).iteritems() %}
 elasticsearch_index_{{ index_name }}:
   {%- if index.get('enabled', False) %}
@@ -19,6 +23,8 @@
   elasticsearch_index_template.absent:
   - name: {{ index_name }}
   {%- endif %}
+  - require:
+    - pkg: elasticsearch_client_packages
 {%- endfor %}
 
 {%- endif %}
diff --git a/elasticsearch/files/grafana_influxdb.json b/elasticsearch/files/grafana_influxdb.json
index 1697da0..9eec5af 100644
--- a/elasticsearch/files/grafana_influxdb.json
+++ b/elasticsearch/files/grafana_influxdb.json
@@ -90,19 +90,12 @@
               "dsType": "influxdb",
               "fill": "",
               "function": "last",
-              "groupBy": [
-                {
-                  "params": [
-                    "auto"
-                  ],
-                  "type": "time"
-                }
-              ],
+              "groupBy": [],
               "groupby_field": "",
               "interval": "",
               "measurement": "cluster_status",
               "policy": "default",
-              "query": "SELECT last(\"value\") FROM \"cluster_status\" WHERE \"cluster_name\" = 'elasticsearch' AND $timeFilter GROUP BY time($interval)",
+              "query": "SELECT last(\"value\") FROM \"cluster_status\" WHERE \"cluster_name\" = 'elasticsearch' AND $timeFilter",
               "rawQuery": false,
               "refId": "A",
               "resultFormat": "time_series",
@@ -123,10 +116,11 @@
               "tags": [
                 {
                   "key": "environment_label",
-                  "operator": "=",
-                  "value": "$environment"
+                  "operator": "=~",
+                  "value": "/^$environment$/"
                 },
                 {
+                  "condition": "AND",
                   "key": "cluster_name",
                   "operator": "=",
                   "value": "elasticsearch"
@@ -232,17 +226,10 @@
             {
               "alias": "number",
               "dsType": "influxdb",
-              "groupBy": [
-                {
-                  "params": [
-                    "auto"
-                  ],
-                  "type": "time"
-                }
-              ],
+              "groupBy": [],
               "measurement": "elasticsearch_cluster_number_of_nodes",
               "policy": "default",
-              "query": "SELECT last(\"value\") FROM \"elasticsearch_cluster_number_of_nodes\" WHERE $timeFilter GROUP BY time($interval)",
+              "query": "SELECT last(\"value\") FROM \"elasticsearch_cluster_number_of_nodes\" WHERE $timeFilter",
               "rawQuery": false,
               "refId": "A",
               "resultFormat": "time_series",
@@ -263,8 +250,8 @@
               "tags": [
                 {
                   "key": "environment_label",
-                  "operator": "=",
-                  "value": "$environment"
+                  "operator": "=~",
+                  "value": "/^$environment$/"
                 }
               ]
             }
@@ -726,17 +713,10 @@
               "column": "value",
               "dsType": "influxdb",
               "function": "last",
-              "groupBy": [
-                {
-                  "params": [
-                    "auto"
-                  ],
-                  "type": "time"
-                }
-              ],
+              "groupBy": [],
               "measurement": "lma_components_threads",
               "policy": "default",
-              "query": "SELECT last(\"value\") FROM \"lma_components_threads\" WHERE \"service\" = 'elasticsearch' AND \"hostname\" =~ /^$server$/ AND $timeFilter GROUP BY time($interval)",
+              "query": "SELECT last(\"value\") FROM \"lma_components_threads\" WHERE \"service\" = 'elasticsearch' AND \"hostname\" =~ /^$server$/ AND $timeFilter",
               "rawQuery": false,
               "refId": "A",
               "resultFormat": "time_series",
@@ -763,8 +743,8 @@
                 {
                   "condition": "AND",
                   "key": "hostname",
-                  "operator": "=",
-                  "value": "$server"
+                  "operator": "=~",
+                  "value": "/^$server$/"
                 }
               ]
             }
@@ -1333,5 +1313,5 @@
   },
   "timezone": "browser",
   "title": "Elasticsearch",
-  "version": 3
-}
\ No newline at end of file
+  "version": 4
+}
diff --git a/elasticsearch/map.jinja b/elasticsearch/map.jinja
index e2d7871..36dd674 100644
--- a/elasticsearch/map.jinja
+++ b/elasticsearch/map.jinja
@@ -20,7 +20,15 @@
 {%- set server = salt['grains.filter_by'](base_defaults, merge=salt['pillar.get']('elasticsearch:server')) %}
 
 {%- load_yaml as client_defaults %}
-default:
+Debian:
+  pkgs:
+  - python-elasticsearch
+  server:
+    host: 127.0.0.1
+    port: 9200
+RedHat:
+  pkgs:
+  - python-elasticsearch
   server:
     host: 127.0.0.1
     port: 9200
diff --git a/elasticsearch/meta/heka.yml b/elasticsearch/meta/heka.yml
index 8b13789..90b3ae7 100644
--- a/elasticsearch/meta/heka.yml
+++ b/elasticsearch/meta/heka.yml
@@ -1 +1,80 @@
-
+{%- if pillar.elasticsearch.server is defined %}
+metric_collector:
+  trigger:
+    elasticsearch_check:
+      description: 'Elasticsearch cannot be checked'
+      severity: down
+      rules:
+      - metric: elasticsearch_check
+        relational_operator: '=='
+        threshold: 0
+        window: 60
+        periods: 0
+        function: last
+    elasticsearch_health_critical:
+      description: 'Elasticsearch cluster health is critical'
+      severity: critical
+      rules:
+      - metric: elasticsearch_cluster_health
+        relational_operator: '=='
+        threshold: 3 # red
+        window: 60
+        function: min
+    elasticsearch_health_warning:
+      description: 'Elasticsearch cluster health is warning'
+      severity: warning
+      rules:
+      - metric: elasticsearch_cluster_health
+        relational_operator: '=='
+        threshold: 2 # yellow
+        window: 60
+        function: min
+  alarm:
+    elasticsearch_check:
+      alerting: enabled
+      triggers:
+      - elasticsearch_check
+      dimension:
+        service: elasticsearch
+    elasticsearch_health:
+      alerting: enabled
+      triggers:
+      - elasticsearch_health_critical
+      - elasticsearch_health_warning
+      dimension:
+        cluster: elasticsearch
+aggregator:
+  alarm_cluster:
+    elasticsearch_service:
+      policy: majority_of_members
+      alerting: enabled
+      group_by: hostname
+      match:
+        service: elasticsearch
+      members:
+      - elasticsearch_check
+      dimension:
+        service: elasticsearch-cluster
+        nagios_host: 01-service-clusters
+    elasticsearch_cluster:
+      policy: highest_severity
+      alerting: enabled
+      match:
+        cluster: elasticsearch
+      members:
+      - elasticsearch_health
+      dimension:
+        service: elasticsearch-cluster
+        nagios_host: 01-service-clusters
+    elasticsearch:
+      policy: highest_severity
+      alerting: enabled_with_notification
+      match:
+        service: elasticsearch-cluster
+      members:
+      - elasticsearch_service
+      - elasticsearch_cluster
+      dimension:
+        cluster_name: elasticsearch
+        nagios_host: 00-top-clusters
+{%- endif %}