diff --git a/salt/telegraf/etc/telegraf.conf b/salt/telegraf/etc/telegraf.conf
index 878d79caa..8b37632ce 100644
--- a/salt/telegraf/etc/telegraf.conf
+++ b/salt/telegraf/etc/telegraf.conf
@@ -681,10 +681,10 @@
 [[inputs.logstash]]
   url = "http://localhost:9600"
   collect = ["pipelines"]
-  {%- if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %}
+{%-   if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %}
   username = "{{ salt['pillar.get']('elasticsearch:auth:users:so_logstash_user:user') }}"
   password = "{{ salt['pillar.get']('elasticsearch:auth:users:so_logstash_user:pass') }}"
-  {% endif %}
+{%-   endif %}
 {%- endif %}
 
 {# if grains.role in ['so-eval','so-standalone','so-manager', 'so-managersearch', 'so-heavynode'] -%}
@@ -692,13 +692,15 @@
   servers = ["tcp://localhost:6379"]
 {%- endif #}
 
-{% if grains.role == 'so-node' %}
+{%- if grains.role in ['so-node', 'so-sensor', 'so-eval', 'so-manager', 'so-standalone', 'so-managersearch', 'so-heavynode'] %}
 [[inputs.beat]]
   url = "http://127.0.0.1:5066"
-  include = ["libbeat"]
+  include = ["filebeat", "libbeat"]
+{%-   if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %}
   username = "{{ salt['pillar.get']('elasticsearch:auth:users:so_beats_user:user') }}"
   password = "{{ salt['pillar.get']('elasticsearch:auth:users:so_beats_user:pass') }}"
-{% endif %}
+{%-   endif %}
+{%- endif %}
 
 # # Read metrics from one or more commands that can output to stdout
 [[inputs.exec]]
@@ -709,7 +711,6 @@
    timeout = "15s"
    interval = "60s"
 
-
 #   ## Commands array
 {% if grains['role'] in ['so-manager'] %}
 [[inputs.exec]]