diff --git a/nova/files/heka.conf b/nova/files/heka.conf
new file mode 100644
index 0000000..e99404f
--- /dev/null
+++ b/nova/files/heka.conf
@@ -0,0 +1,46 @@
+input:
+  {%- if pillar.nova.compute is defined %}
+  nova_compute:
+    engine: logstreamer
+    log_directory: /var/log/nova
+    file_match: nova-compute\.log\.?(?P<Index>\d+)?(.gz)?
+    priority: ["^Index"]
+    decoder: multidecoder_openstack
+  libvirtd:
+    engine: logstreamer
+    log_directory: /var/log/libvirt
+    file_match: libvirtd\.log\.?(?P<Index>\d+)?(.gz)?
+    priority: ['^Index']
+    decoder: multidecoder_libvirtd
+  {%- endif %}
+decoder:
+  openstack:
+    engine: multidecoder
+    subs: [ 'Payloadregex_OpenStackLog','Payloadregex_OpenStackLogTrace' ]
+    cascade_strategy: first-wins
+    log_sub_errors: "false"
+  OpenStackLog:
+    engine: payloadregex
+    match_regex: ^(?P<timestamp>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}.\d{3})\s(?P<pid>\d+)\s(?P<severity>\w+)\s(?P<programname>\D+)\s\[(?P<id>.+)\]\s(?P<payload>.*)
+    timestamp_layout: "2015-10-06 11:34:37.243"
+  OpenStackLogTrace:
+    engine: payloadregex
+    match_regex: ^(?P<timestamp>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}.\d{3})\s(?P<pid>\d+)\s(?P<severity>TRACE)\s(?P<programname>.\S+)\s(?P<payload>.*)
+    timestamp_layout: "2015-10-06 11:34:37.243"
+  openstacksandbox:
+    engine: sandbox
+    file_name: "/etc/heka/plugins.d/decoders/openstack.lua"
+    module_directory: "/etc/heka/plugins.d/common;/usr/share/heka/lua_modules"
+  libvirtd:
+    engine: multidecoder
+    subs: [ 'Payloadregex_libvirtcommon', 'Payloadregex_libvirtaudit' ]
+    cascade_strategy: first-wins
+    log_sub_errors: "false"
+  libvirtcommon:
+    engine: payloadregex
+    match_regex: ^(?P<timestamp>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}.\d{3}\+\d{4}):\s+(?P<pid>\d+):\s+(?P<severity>\w+)\s+:\s+(?P<qemutrace>\w+:\d+)\s+:\s+(?P<payload>.*)
+    timestamp_layout: "2015-09-01 15:56:14.675+0000"
+  libvirtaudit:
+    engine: payloadregex
+    match_regex: ^(?P<timestamp>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}.\d{3}\+\d{4}):\s+(?P<pid>\d+):\s+(?P<severity>\w+)\s+:\s+(?P<message>.+):\s(?P<payload>.+)
+    timestamp_layout: "2015-09-01 15:56:14.675+0000"