diff --git a/fluentd/files/match/forward.conf b/fluentd/files/match/forward.conf
new file mode 100644
index 0000000..43cd2f7
--- /dev/null
+++ b/fluentd/files/match/forward.conf
@@ -0,0 +1,9 @@
+  @type forward
+  flush_interval {{ values.get("flush_interval", "10s") }}
+  request_timeout {{ values.get("request_timeout", "10s") }}
+  disable_retry_limit
+  <server>
+    name aggregator
+    host {{ values.host }}
+    port {{ values.get("port", 24224) }}
+  </server>
diff --git a/metadata/service/agent/output/elasticsearch.yml b/metadata/service/agent/output/elasticsearch.yml
index 29921d0..8bf4705 100644
--- a/metadata/service/agent/output/elasticsearch.yml
+++ b/metadata/service/agent/output/elasticsearch.yml
@@ -1,25 +1,11 @@
 classes:
-- service.fluentd.agent.single
+- service.fluentd.agent.output.filter.common
 parameters:
   fluentd:
     agent:
       config:
         label:
           default_output:
-            filter:
-              add_general_fields:
-                tag: "**"
-                type: record_transformer
-                enable_ruby: true
-                record:
-                  - name: Type
-                    value: log
-                  - name: environment_label
-                    value: ${_param:cluster_domain}
-                  - name: Hostname
-                    value: ${fluentd:dollar}{ hostname }
-                  - name: Timestamp
-                    value: ${fluentd:dollar}{ time.strftime('%Y-%m-%dT%H:%M:%S.%N%z') }
             match:
               elasticsearch_output:
                 tag: "**"
diff --git a/metadata/service/agent/output/filter/common.yml b/metadata/service/agent/output/filter/common.yml
new file mode 100644
index 0000000..e59c7d9
--- /dev/null
+++ b/metadata/service/agent/output/filter/common.yml
@@ -0,0 +1,22 @@
+classes:
+- service.fluentd.agent.single
+parameters:
+  fluentd:
+    agent:
+      config:
+        label:
+          default_output:
+            filter:
+              add_general_fields:
+                tag: "**"
+                type: record_transformer
+                enable_ruby: true
+                record:
+                  - name: Type
+                    value: log
+                  - name: environment_label
+                    value: ${_param:cluster_domain}
+                  - name: Hostname
+                    value: ${fluentd:dollar}{ hostname }
+                  - name: Timestamp
+                    value: ${fluentd:dollar}{ time.strftime('%Y-%m-%dT%H:%M:%S.%N%z') }
diff --git a/metadata/service/agent/output/forward.yml b/metadata/service/agent/output/forward.yml
new file mode 100644
index 0000000..e49957c
--- /dev/null
+++ b/metadata/service/agent/output/forward.yml
@@ -0,0 +1,15 @@
+classes:
+- service.fluentd.agent.output.filter.common
+parameters:
+  fluentd:
+    agent:
+      config:
+        label:
+          default_output:
+            match:
+              forward_output:
+                tag: "**"
+                type: forward
+                server_name: aggregator
+                host: 127.0.0.1
+                port: 24224