diff --git a/heka/files/00-hekad.toml b/heka/files/00-hekad.toml
index baecf51..99cad61 100644
--- a/heka/files/00-hekad.toml
+++ b/heka/files/00-hekad.toml
@@ -1,4 +1,3 @@
 [hekad]
 {%- set workers = grains.num_cpus + 1 %}
 maxprocs = {{ workers }}
-
diff --git a/heka/files/decoder/openstack.toml b/heka/files/decoder/openstack.toml
new file mode 100644
index 0000000..16fa1f0
--- /dev/null
+++ b/heka/files/decoder/openstack.toml
@@ -0,0 +1,32 @@
+[OpenStackDecoder]
+type = "MultiDecoder"
+subs = [ 'OpenStack','OpenStackTrace' ]
+#cascade_strategy = "all"
+cascade_strategy = "first-wins"
+log_sub_errors = false
+
+[OpenStack]
+type = "PayloadRegexDecoder"
+match_regex = '^(?P<timestamp>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}.\d{3})\s(?P<pid>\d+)\s(?P<severity>\w+)\s(?P<programname>\D+)\s\[(?P<id>.+)\]\s(?P<payload>.*)'
+timestamp_layout = "2015-10-06 11:34:37.243"
+
+[OpenStackTrace]
+type = "PayloadRegexDecoder"
+match_regex = '^(?P<timestamp>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}.\d{3})\s(?P<pid>\d+)\s(?P<severity>TRACE)\s(?P<programname>.\S+)\s(?P<Payload>.*)'
+timestamp_layout = "2015-10-06 11:34:37.243"
+
+[OpenStack.message_fields]
+type = "OpenstackLogFile"
+logger = "%programname%"
+pid = "%pid%"
+Payload = "%payload%"
+
+[OpenStackTrace.message_fields]
+type = "OpenstackLogFile"
+logger = "%programname%"
+pid = "%pid%"
+
+#[ElseDecoder]
+#type = "PayloadRegexDecoder"
+#match_regex = '(.*)'
+
diff --git a/heka/files/decoder/salt.toml b/heka/files/decoder/salt.toml
new file mode 100644
index 0000000..bb4ec51
--- /dev/null
+++ b/heka/files/decoder/salt.toml
@@ -0,0 +1,9 @@
+[RsyslogDecoder]
+type = "SandboxDecoder"
+filename = "lua_decoders/rsyslog.lua"
+
+[RsyslogDecoder.config]
+type = "RSYSLOG_TraditionalFileFormat"
+template = '%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n'
+tz = "Europe/Prague"
+
diff --git a/heka/files/encoder/RstEncoder.toml b/heka/files/encoder/RstEncoder.toml
index 268f355..7b094d1 100644
--- a/heka/files/encoder/RstEncoder.toml
+++ b/heka/files/encoder/RstEncoder.toml
@@ -1,3 +1,2 @@
 [RstEncoder]
 type = "RstEncoder"
-
diff --git a/heka/files/encoder/es-json.toml b/heka/files/encoder/es-json.toml
index 68ceecf..170dd36 100644
--- a/heka/files/encoder/es-json.toml
+++ b/heka/files/encoder/es-json.toml
@@ -7,4 +7,3 @@
 {%- else -%}
 es_index_from_timestamp = false
 {%- endif -%}
-
diff --git a/heka/files/input/amqp.toml b/heka/files/input/amqp.toml
index d05a6f6..2611b90 100644
--- a/heka/files/input/amqp.toml
+++ b/heka/files/input/amqp.toml
@@ -20,4 +20,3 @@
 {% endif %}
 decoder = "{{ values.decoder }}"
 splitter = "{{ values.splitter }}"
-
diff --git a/heka/files/input/logstreamer.toml b/heka/files/input/logstreamer.toml
index 527a19b..9299597 100644
--- a/heka/files/input/logstreamer.toml
+++ b/heka/files/input/logstreamer.toml
@@ -11,4 +11,3 @@
 {% if values.splitter is defined %}
 splitter = {{ values.splitter }}
 {% endif %}
-
diff --git a/heka/files/logstreamer-rsyslog.toml b/heka/files/logstreamer-rsyslog.toml
new file mode 100644
index 0000000..7dbf4ae
--- /dev/null
+++ b/heka/files/logstreamer-rsyslog.toml
@@ -0,0 +1,38 @@
+[LogstreamerInputSyslog]
+type = "LogstreamerInput"
+log_directory = "/var/log"
+file_match = 'syslog\.?(?P<Index>\d+)?(.gz)?'
+priority = ["^Index"]
+decoder = "RsyslogDecoder"
+
+[LogstreamerInputAuthlog]
+type = "LogstreamerInput"
+log_directory = "/var/log"
+file_match = 'auth\.log\.?(?P<Index>\d+)?(.gz)?'
+priority = ["^Index"]
+decoder = "RsyslogDecoder"
+
+[LogstreamerInputAuthKernlog]
+type = "LogstreamerInput"
+log_directory = "/var/log"
+file_match = 'kern\.log\.?(?P<Index>\d+)?(.gz)?'
+priority = ["^Index"]
+decoder = "RsyslogDecoder"
+
+[LogstreamerInputAuthMaillog]
+type = "LogstreamerInput"
+log_directory = "/var/log"
+file_match = 'mail\.log?(?P<Index>\d+)?(.gz)?|mail\.err?(?P<Index>\d+)?(.gz)?'
+priority = ["^Index"]
+decoder = "RsyslogDecoder"
+
+[RsyslogDecoder]
+type = "SandboxDecoder"
+filename = "lua_decoders/rsyslog.lua"
+
+[RsyslogDecoder.config]
+type = "RSYSLOG_TraditionalFileFormat"
+template = '%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n'
+tz = "Europe/Prague"
+# hostname_keep = 'TRUE'
+
diff --git a/heka/files/output/amqp.toml b/heka/files/output/amqp.toml
index 58eb679..1d95a43 100644
--- a/heka/files/output/amqp.toml
+++ b/heka/files/output/amqp.toml
@@ -11,4 +11,3 @@
 max_delay = "30s"
 delay = "250ms"
 max_retries = 5
-
diff --git a/heka/files/output/dashboard.toml b/heka/files/output/dashboard.toml
index 30121f4..72c74c1 100644
--- a/heka/files/output/dashboard.toml
+++ b/heka/files/output/dashboard.toml
@@ -3,4 +3,3 @@
 address = "{{ values.dashboard_address }}:{{ values.dashboard_port }}"
 {% endif %}
 ticker_interval = {{ values.ticker_interval }}
-
diff --git a/heka/files/output/elasticsearch.toml b/heka/files/output/elasticsearch.toml
index 410e65b..b50a5ac 100644
--- a/heka/files/output/elasticsearch.toml
+++ b/heka/files/output/elasticsearch.toml
@@ -6,4 +6,3 @@
 
 [output_{{ name }}.buffering]
 max_file_size = 268435456
-
diff --git a/heka/files/output/logoutput.toml b/heka/files/output/logoutput.toml
index 38bb08b..0df4f54 100644
--- a/heka/files/output/logoutput.toml
+++ b/heka/files/output/logoutput.toml
@@ -1,4 +1,3 @@
 [LogOutput]
 encoder = "{{ values.encoder }}"
 message_matcher = "{{ values.message_matcher }}"
-