diff --git a/fluentd/label/default_output/elasticsearch.yml b/fluentd/label/default_output/elasticsearch.yml
index aa96b31..398ea8c 100644
--- a/fluentd/label/default_output/elasticsearch.yml
+++ b/fluentd/label/default_output/elasticsearch.yml
@@ -1,5 +1,6 @@
 classes:
 - service.fluentd.agent.output.elasticsearch
+- system.fluentd.label.default_output.filter.common
 parameters:
   _param:
     fluentd_elasticsearch_host: 127.0.0.1
@@ -9,32 +10,6 @@
       config:
         label:
           default_output:
-            filter:
-              drop_nested_timestamp_and_sensitive_data:
-                tag: "openstack.**"
-                type: record_transformer
-                enable_ruby: true
-                remove_keys: '["_dummy_1", "_dummy_2", "_dummy_3"]'
-                record:
-                  - name: _dummy_1
-                    value: ${fluentd:dollar}{if record.has_key?("context"); record["context"].delete("timestamp") ; end; nil }
-                  - name: _dummy_2
-                    value: ${fluentd:dollar}{if record.has_key?("context"); record["context"].delete("auth_token"); end; nil}
-                  - name: _dummy_3
-                    value: ${fluentd:dollar}{if record.has_key?("context"); record["context"].delete("auth_token_info"); end; nil}
-              drop_hostname_field:
-                tag: "openstack.**"
-                type: record_transformer
-                enable_ruby: true
-                remove_keys: '["hostname"]'
-              change_pid_field_value:
-                tag: "haproxy.**"
-                type: record_transformer
-                enable_ruby: true
-                record:
-                  - name: Pid
-                    value: ${fluentd:dollar}{record["pid"]}
-                remove_keys: '["pid"]'
             match:
               elasticsearch_output:
                 host: ${_param:fluentd_elasticsearch_host}
diff --git a/fluentd/label/default_output/filter/common.yml b/fluentd/label/default_output/filter/common.yml
new file mode 100644
index 0000000..e9d2a67
--- /dev/null
+++ b/fluentd/label/default_output/filter/common.yml
@@ -0,0 +1,32 @@
+parameters:
+  fluentd:
+    agent:
+      config:
+        label:
+          default_output:
+            filter:
+              drop_nested_timestamp_and_sensitive_data:
+                tag: "openstack.**"
+                type: record_transformer
+                enable_ruby: true
+                remove_keys: '["_dummy_1", "_dummy_2", "_dummy_3"]'
+                record:
+                  - name: _dummy_1
+                    value: ${fluentd:dollar}{if record.has_key?("context"); record["context"].delete("timestamp") ; end; nil }
+                  - name: _dummy_2
+                    value: ${fluentd:dollar}{if record.has_key?("context"); record["context"].delete("auth_token"); end; nil}
+                  - name: _dummy_3
+                    value: ${fluentd:dollar}{if record.has_key?("context"); record["context"].delete("auth_token_info"); end; nil}
+              drop_hostname_field:
+                tag: "openstack.**"
+                type: record_transformer
+                enable_ruby: true
+                remove_keys: '["hostname"]'
+              change_pid_field_value:
+                tag: "haproxy.**"
+                type: record_transformer
+                enable_ruby: true
+                record:
+                  - name: Pid
+                    value: ${fluentd:dollar}{record["pid"]}
+                remove_keys: '["pid"]'
diff --git a/fluentd/label/default_output/forward.yml b/fluentd/label/default_output/forward.yml
new file mode 100644
index 0000000..50f55fa
--- /dev/null
+++ b/fluentd/label/default_output/forward.yml
@@ -0,0 +1,16 @@
+classes:
+- service.fluentd.agent.output.forward
+- system.fluentd.label.default_output.filter.common
+parameters:
+  _param:
+    fluentd_forward_host: 127.0.0.1
+    fluentd_forward_port: 24224
+  fluentd:
+    agent:
+      config:
+        label:
+          default_output:
+            match:
+              forward_output:
+                host: ${_param:fluentd_forward_host}
+                port: ${_param:fluentd_forward_port}