diff --git a/metadata/service/support.yml b/metadata/service/support.yml
index 7399f96..9beb7a7 100644
--- a/metadata/service/support.yml
+++ b/metadata/service/support.yml
@@ -6,7 +6,7 @@
       collectd:
         enabled: false
       heka:
-        enabled: false
+        enabled: true
       sensu:
         enabled: true
       sphinx:
diff --git a/salt/files/heka.toml b/salt/files/heka.toml
new file mode 100644
index 0000000..08a5be6
--- /dev/null
+++ b/salt/files/heka.toml
@@ -0,0 +1,47 @@
+{%- if pillar.salt.minion is defined %}
+[logstreamer_salt_minion]
+type = "LogstreamerInput"
+log_directory = "/var/log/salt"
+file_match = 'minion-?(?P<Index>\d+)?(\.gz)?'
+priority = ["^Index"]
+decoder = "Sandbox_salt_minion"
+
+[Sandbox_salt_minion]
+type = "PayloadRegexDecoder"
+match_regex = '^(?P<Timestamp>[0-9\-]+ [0-9:]+),\d+ \[(?P<Module>[\w\d\.]+)[\ \t]*\]\[(?P<Severity>\w+)[\ \t]*\]\[(?P<JID>\d+)\] (?P<Payload>.*)'
+timestamp_layout = "2006-01-02 15:04:05"
+
+[Sandbox_salt_minion.severity_map]
+DEBUG = 7
+INFO = 6
+WARNING = 4
+ERROR = 3
+
+[Sandbox_salt_minion.message_fields]
+Module = "%Module%"
+JID = "%JID%"
+{%- endif %}
+
+{% if pillar.salt.master is defined %}
+[logstreamer_salt_master]
+type = "LogstreamerInput"
+log_directory = "/var/log/salt"
+file_match = 'master-?(?P<Index>\d+)?(\.gz)?'
+priority = ["^Index"]
+decoder = "Sandbox_salt_master"
+
+[Sandbox_salt_master]
+type = "PayloadRegexDecoder"
+match_regex = '^(?P<Timestamp>[0-9\-]+ [0-9:]+),\d+ \[(?P<Module>[\w\d\.]+)[\ \t]*\]\[(?P<Severity>\w+)[\ \t]*\]\[(?P<JID>\d+)\] (?P<Payload>.*)'
+timestamp_layout = "2006-01-02 15:04:05"
+
+[Sandbox_salt_master.severity_map]
+DEBUG = 7
+INFO = 6
+WARNING = 4
+ERROR = 3
+
+[Sandbox_salt_master.message_fields]
+Module = "%Module%"
+JID = "%JID%"
+{%- endif %}