diff --git a/_modules/rsyslog_util.py b/_modules/rsyslog_util.py
new file mode 100644
index 0000000..d58a1c4
--- /dev/null
+++ b/_modules/rsyslog_util.py
@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+
+import os
+
+
+def syslog_file_match(output):
+    """
+    Return patterns to be used in logstreamer file_match config params.
+
+    For example the function may return this dict:
+
+    {
+      "/var/log": "kern\.log|auth\.log|syslog|mail\.log|mail\.err"
+    }
+    """
+    file_match = {}
+    for name, config in output.get('file', {}).items():
+        if not config.get('enabled', False):
+            continue
+        logdir = os.path.dirname(name)
+        pattern = os.path.basename(name).replace('.', '\.')
+        if logdir in file_match:
+            file_match[logdir] = file_match[logdir] + '|' + pattern
+        else:
+            file_match[logdir] = pattern
+    return file_match
diff --git a/rsyslog/meta/heka.yml b/rsyslog/meta/heka.yml
index 1edc313..9615b07 100644
--- a/rsyslog/meta/heka.yml
+++ b/rsyslog/meta/heka.yml
@@ -13,14 +13,19 @@
         {%- else %}
         syslog_pattern: '%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%\n'
         {%- endif %}
+  {%- set file_match = salt['rsyslog_util.syslog_file_match'](global.output) %}
+  {%- if file_match|length > 0 %}
   input:
-    syslog:
+    {%- for logdir, pattern in file_match.iteritems() %}
+    syslog{{ logdir.replace('/', '_') }}:
       engine: logstreamer
-      log_directory: "/var/log"
-      file_match: '(?P<Service>daemon\.log|cron\.log|haproxy\.log|kern\.log|auth\.log|syslog|messages|debug)'
+      log_directory: "{{ logdir }}"
+      file_match: '(?P<Service>{{ pattern }})'
       differentiator: [ 'system.', 'Service' ]
       decoder: "syslog_decoder"
       splitter: "TokenSplitter"
+    {%- endfor %}
+  {%- endif %}
   filter:
     hdd_errors:
       engine: sandbox