diff --git a/metadata/service/client/single.yml b/metadata/service/client/single.yml
index c86acaf..d2dcf1d 100644
--- a/metadata/service/client/single.yml
+++ b/metadata/service/client/single.yml
@@ -1,5 +1,7 @@
 applications:
 - rsyslog
+classes:
+- service.rsyslog.support
 parameters:
   rsyslog:
     client:
diff --git a/metadata/service/support.yml b/metadata/service/support.yml
new file mode 100644
index 0000000..05eaa61
--- /dev/null
+++ b/metadata/service/support.yml
@@ -0,0 +1,13 @@
+parameters:
+  rsyslog:
+    _support:
+      collectd:
+        enabled: false
+      heka:
+        enabled: true
+      sensu:
+        enabled: false
+      sphinx:
+        enabled: false
+      grafana:
+        enabled: false
diff --git a/rsyslog/meta/heka.yml b/rsyslog/meta/heka.yml
new file mode 100644
index 0000000..1edc313
--- /dev/null
+++ b/rsyslog/meta/heka.yml
@@ -0,0 +1,35 @@
+{%- from "rsyslog/map.jinja" import global with context %}
+log_collector:
+  decoder:
+    syslog:
+      engine: sandbox
+      module_file: /usr/share/lma_collector/decoders/generic_syslog.lua
+      module_dir: /usr/share/lma_collector/common;/usr/share/heka/lua_modules
+      adjust_timezone: true
+      config:
+        {%- if global.format is defined %}
+        syslog_pattern: '{{ global.format.template }}'
+        fallback_syslog_pattern: '%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%\n'
+        {%- else %}
+        syslog_pattern: '%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%\n'
+        {%- endif %}
+  input:
+    syslog:
+      engine: logstreamer
+      log_directory: "/var/log"
+      file_match: '(?P<Service>daemon\.log|cron\.log|haproxy\.log|kern\.log|auth\.log|syslog|messages|debug)'
+      differentiator: [ 'system.', 'Service' ]
+      decoder: "syslog_decoder"
+      splitter: "TokenSplitter"
+  filter:
+    hdd_errors:
+      engine: sandbox
+      module_file: /usr/share/lma_collector/filters/hdd_errors_counter.lua
+      module_dir: /usr/share/lma_collector/common;/usr/share/heka/lua_modules
+      preserve_data: false
+      message_matcher: "Type == 'log' && Logger == 'system.kern'"
+      ticker_interval: 10
+      config:
+        grace_interval: 10
+        patterns: "/error%s.+([sv]d[a-z][a-z]?)%d?/ /([sv]d[a-z][a-z]?)%d?.+%serror/"
+        hostname: '{{ grains.host }}'