diff --git a/.kitchen.yml b/.kitchen.yml
index 82949e7..435e878 100644
--- a/.kitchen.yml
+++ b/.kitchen.yml
@@ -46,6 +46,9 @@ provisioner:
         number_of_replicas: 0
         # so the kitchen node doesn't have unallocated replica shards
         # and comes up green (healthy) instead of yellow
+      discovery:
+        zen:
+          minimum_master_nodes: 1 # since search returns more than one, but they are fake
     elkstack:
       config:
         kibana:
@@ -64,42 +67,20 @@ platforms:
 
 suites:
   - name: default # server
-    data_bags_path: "test/integration/default/data_bags"
-    encrypted_data_bag_secret_key_path: "test/integration/default/encrypted_data_bag_secret"
     run_list:
-      - recipe[elkstack::java]
-      - recipe[elkstack::cluster] # not testing single, it's practically the same
-    attributes:
-      elasticsearch:
-        discovery:
-          zen:
-            minimum_master_nodes: 1 # since search returns more than one, but they are fake
+      - recipe[java::default]
+      - recipe[elkstack::default]
 
-  - name: lumberjack # server with lumberjack disabled
-    data_bags_path: "test/integration/default/data_bags"
-    encrypted_data_bag_secret_key_path: "test/integration/default/encrypted_data_bag_secret"
-    run_list:
-      - recipe[elkstack::java]
-      - recipe[elkstack::cluster] # not testing single, it's practically the same
-    attributes:
-      elkstack:
-        config:
-          lumberjack_data_bag: false
-      elasticsearch:
-        discovery:
-          zen:
-            minimum_master_nodes: 1 # since search returns more than one, but they are fake
-
-  - name: agent
-    data_bags_path: "test/integration/agent/data_bags"
-    encrypted_data_bag_secret_key_path: "test/integration/agent/encrypted_data_bag_secret"
+  - name: agent # java agent with server
     run_list:
       - recipe[wrapper::logstash_override]
-      - recipe[elkstack::java]
+      - recipe[java::default]
       - recipe[elkstack::agent]
 
-  - name: forwarder
-    data_bags_path: "test/integration/agent/data_bags"
-    encrypted_data_bag_secret_key_path: "test/integration/agent/encrypted_data_bag_secret"
+  - name: forwarder # alternative golang agent with server
+    data_bags_path: "test/integration/forwarder/data_bags"
+    encrypted_data_bag_secret_key_path: "test/integration/forwarder/encrypted_data_bag_secret"
     run_list:
+      - recipe[java::default]
+      - recipe[elkstack::default]
       - recipe[elkstack::forwarder]
diff --git a/Berksfile b/Berksfile
index 4f58eaf..da47cd8 100644
--- a/Berksfile
+++ b/Berksfile
@@ -2,28 +2,13 @@ source "https://api.berkshelf.com"
 
 metadata
 
+cookbook 'java'
+
 # until https://github.com/elastic/cookbook-elasticsearch/pull/230
 cookbook 'elasticsearch', '~> 0.3', git:'git@github.com:racker/cookbook-elasticsearch.git'
 
-# until https://github.com/poise/python/pull/120
-cookbook 'python', git: 'git@github.com:racker/python.git'
-
-# until https://github.com/lusis/chef-logstash/issues/394
-cookbook 'logstash', git: 'git@github.com:lusis/chef-logstash.git'
-
-cookbook 'rackspace_iptables', git: 'git@github.com:rackspace-cookbooks/rackspace_iptables.git'
-cookbook 'rackspacecloud', git: 'git@github.com:rackspace-cookbooks/rackspacecloud.git'
-cookbook 'rackspace_gluster', git: 'git@github.com:rackspace-cookbooks/rackspace_gluster.git'
-cookbook 'rackops_rolebook', git: 'git@github.com:rackops/rackops_rolebook.git'
-
-# not published
-cookbook 'rackspace_cloudbackup', git:'git@github.com:rackspace-cookbooks/rackspace_cloudbackup.git'
-
 group :integration do
   cookbook 'wrapper', path: 'test/fixtures/cookbooks/wrapper'
   cookbook 'apt'
   cookbook 'yum'
 end
-
-# until https://github.com/opscode-cookbooks/openssl/pull/11
-cookbook 'openssl', git: 'git@github.com:racker/openssl.git'
diff --git a/README.md b/README.md
index 204a04d..25b74d8 100644
--- a/README.md
+++ b/README.md
@@ -22,9 +22,9 @@ upstream attributes have been exposed/overriden for our needs.
 
 - This cookbook requires java. Because not everyone has the same desires for
 java versions, concurrently installed versions, or particular vendor versions,
-this cookbook simply assumes you have already satisfied this requirement. If you
-want just 'some java', feel free to use the `::java` recipe and it will include
-the community java cookbook with default values.
+this cookbook simply assumes you have already satisfied this requirement. This
+cookbook _does_ ship with default attributes to make the community cookbook use
+Java 7 over the default of Java 6.
 
 - You must update your Berksfile to use this cookbook. Due to the upstream
 changes constantly occuring, you should consult the `Berksfile` in this cookbook
@@ -115,12 +115,6 @@ CentOS 6.5
     <td>Default logstash instance name</td>
     <td><tt>server</tt></td>
   </tr>
-  <tr>
-    <td><tt>['elkstack']['config']['cluster']</tt></td>
-    <td>Boolean</td>
-    <td>Whether to search for and connect Elasticsearch to cluster nodes</td>
-    <td><tt>false</tt></td>
-  </tr>
   <tr>
     <td><tt>['elasticsearch']['discovery']['search_query']</tt></td>
     <td>String</td>
@@ -228,20 +222,10 @@ To override anything else, set the appropriate node hash (`logstash`, `kibana`,
 
 ### elkstack::default
 
-Default recipe, does not do anything.
-
-### elkstack::single
-
 A simple wrapper recipe that sets up Elasticsearch, Logstash, and Kibana. Also
 configures an rsyslog sink into logstash on the local box. Everything except
 Logstash and Kibana is locked down to listen only on localhost.
 
-### elkstack::cluster
-
-A simple wrapper recipe that sets up Elasticsearch, Logstash, and Kibana. Also
-configures an rsyslog sink into logstash on the local box. Sets the cluster flag
-so that the elasticsearch recipe builds it in a cluster-friendly way.
-
 ### elkstack::agent
 
 A simple wrapper recipe that sets up a logstash agent on the local box. Also
@@ -284,18 +268,11 @@ Leans on the upstream `lusis/chef-kibana` cookbook for most of its work. Sets up
 an nginx site for kibana by default. By default, it also does not pass through
 most of the http paths directly to elasticsearch (whitelist).
 
-### elkstack::java
-
-Wrapper for a java recipe. This is not included on the run list normally, so if
-you don't already, you must include this recipe or get another JVM installed
-before including anything else in this cookbook.
-
 ### elkstack::newrelic
 
 Validates if there is a newrelic license set and based on that, see if the node
-is tagged as 'elkstack' or 'elkstack_cluster' and creates a file with
-elasticsearch details. Installs python, pip and setuptools packages in order to
-support newrelic_meetme_plugin
+is tagged as 'elkstack' and creates a file with elasticsearch details. Installs
+python, pip and setuptools packages in order to support newrelic_meetme_plugin
 
 ## elkstack::acl
 
diff --git a/attributes/default.rb b/attributes/default.rb
index 06e70b5..0a491ca 100644
--- a/attributes/default.rb
+++ b/attributes/default.rb
@@ -4,8 +4,8 @@
 # the name for an agent logstash instance, affects initscript names and other things
 default['elkstack']['config']['logstash']['agent_name'] = 'agent'
 
-# default to not running the cluster search recipe
-default['elkstack']['config']['cluster'] = false
+# attempt to use lumberjack protocol for java agents?
+default['elkstack']['config']['agent_protocol'] = 'tcp_udp' # could also be lumberjack
 
 # attempt to use performance cloud data disk
 default['elkstack']['config']['data_disk']['disk_config_type'] = false
diff --git a/attributes/elasticsearch.rb b/attributes/elasticsearch.rb
index a6ab730..1d35318 100644
--- a/attributes/elasticsearch.rb
+++ b/attributes/elasticsearch.rb
@@ -28,7 +28,7 @@
 default['elasticsearch']['network']['host'] = '_eth1:ipv4_'
 
 # rubocop:disable LineLength
-default['elasticsearch']['discovery']['search_query'] = "tags:elkstack_cluster AND chef_environment:#{node.chef_environment} AND elasticsearch_cluster_name:#{node['elasticsearch']['cluster']['name']} AND NOT name:#{node.name}"
+default['elasticsearch']['discovery']['search_query'] = "tags:elkstack AND chef_environment:#{node.chef_environment} AND elasticsearch_cluster_name:#{node['elasticsearch']['cluster']['name']} AND NOT name:#{node.name}"
 # rubocop:enable LineLength
 
 # by default, won't do multicast
@@ -36,3 +36,6 @@
 
 # in order to use kibana, we must enable dynamic scripting
 default['elasticsearch']['custom_config']['script.disable_dynamic'] = false
+
+# get on a much newer java, required by ES
+default['java']['jdk_version']           = '7' # newer ES requires
diff --git a/attributes/forwarder.rb b/attributes/forwarder.rb
index c4c45d3..cf3ef03 100644
--- a/attributes/forwarder.rb
+++ b/attributes/forwarder.rb
@@ -3,10 +3,6 @@
 default['logstash_forwarder']['user'] = 'root'
 default['logstash_forwarder']['group'] = 'root'
 
-default['logstash_forwarder']['app_dir'] = '/opt/logstash-forwarder'
-default['logstash_forwarder']['git_repo'] = 'https://github.com/elastic/logstash-forwarder.git'
-default['logstash_forwarder']['git_revision'] = 'v0.3.1'
-
 default['logstash_forwarder']['config']['network']['servers'] = []
 default['logstash_forwarder']['config']['network']['ssl certificate'] = './logstash-forwarder.crt'
 default['logstash_forwarder']['config']['network']['ssl key'] = './logstash-forwarder.key'
diff --git a/attributes/java.rb b/attributes/java.rb
deleted file mode 100644
index 1f5d911..0000000
--- a/attributes/java.rb
+++ /dev/null
@@ -1,2 +0,0 @@
-# get on a much newer elasticsearch, override precomputed attributes
-default['java']['jdk_version']           = '7' # newer ES requires
diff --git a/attributes/kibana.rb b/attributes/kibana.rb
index 78856a0..4919097 100644
--- a/attributes/kibana.rb
+++ b/attributes/kibana.rb
@@ -1,6 +1,3 @@
-
-default['elkstack']['kibana4_workaround'] = false
-
 default['kibana']['web_dir'] = '/opt/kibana/current'
 default['kibana']['webserver_port'] = 443
 default['kibana']['webserver_scheme'] = 'https://'
diff --git a/files/default/logstash-forwarder-init b/files/default/logstash-forwarder-init
index c5b9ebd..664f118 100644
--- a/files/default/logstash-forwarder-init
+++ b/files/default/logstash-forwarder-init
@@ -9,7 +9,7 @@
 PATH=/sbin:/usr/sbin:/bin:/usr/bin
 DESC="log shipper"
 NAME=logstash-forwarder
-DAEMON=/opt/logstash-forwarder/logstash-forwarder
+DAEMON=/opt/logstash-forwarder/bin/logstash-forwarder
 DAEMON_ARGS="-config /etc/logstash-forwarder -spool-size 100"
 PIDFILE=/var/run/$NAME.pid
 SCRIPTNAME=/etc/init.d/$NAME
diff --git a/metadata.rb b/metadata.rb
index 8c34a0b..6bb1eef 100644
--- a/metadata.rb
+++ b/metadata.rb
@@ -13,8 +13,6 @@
 depends 'cron', '~> 1.4.3'
 depends 'elasticsearch', '~> 0.3'
 depends 'htpasswd'
-depends 'java'
-depends 'golang'
 depends 'kibana_lwrp'
 depends 'line'
 depends 'logstash'
@@ -22,7 +20,6 @@
 depends 'newrelic_meetme_plugin'
 depends 'nginx'
 depends 'platformstack'
-depends 'python'
 depends 'rsyslog'
 depends 'runit'
 depends 'stack_commons', '>= 0.0.39'
diff --git a/recipes/_secrets.rb b/recipes/_lumberjack_secrets.rb
similarity index 56%
rename from recipes/_secrets.rb
rename to recipes/_lumberjack_secrets.rb
index 662184a..f244b0a 100644
--- a/recipes/_secrets.rb
+++ b/recipes/_lumberjack_secrets.rb
@@ -35,61 +35,16 @@
   end
 end
 
-# generate our own keypair since we don't seem to have one
-if lumberjack_secrets.nil?
-  Chef::Log.warn("Generating a new lumberjack keypair and data bag item #{lumberjack_data_bag}/secrets")
-  cert_file = "#{Chef::Config[:file_cache_path]}/lumberjack.crt"
-  key_file = "#{Chef::Config[:file_cache_path]}/lumberjack.key"
-  openssl_x509 cert_file do
-    common_name 'elkstack'
-    org 'elkstack'
-    org_unit 'elkstack'
-    country 'US'
-    key_file key_file
-    action :nothing
-  end.run_action(:create) # do it at compilation
-
-  ruby_block 'read generated keypair from disk' do
-    block do
-      key_file_contents = IO.read(key_file)
-      cert_file_contents = IO.read(cert_file)
-      node.run_state['lumberjack_decoded_key_tmp'] = Base64.encode64(key_file_contents).tr("\n", '')
-      node.run_state['lumberjack_decoded_certificate_tmp'] = Base64.encode64(cert_file_contents).tr("\n", '')
-    end
-    action :nothing
-  end.run_action(:run) # do it at compilation
-
-  key_contents = node.run_state['lumberjack_decoded_key_tmp']
-  certificate_contents = node.run_state['lumberjack_decoded_certificate_tmp']
-
-  # try to create a data bag and put a random keypair in it next
-  secrets = {
-    'id' => 'secrets',
-    'key' => key_contents,
-    'certificate' => certificate_contents
-  }
-
-  # unencrypted data bag if we just need a shared secret for ourselves
-  lumberjack_secrets_bag = Chef::DataBag.new
-  lumberjack_secrets_bag.name(lumberjack_data_bag)
-  lumberjack_secrets_bag.save
-
-  lumberjack_secrets = Chef::DataBagItem.new
-  lumberjack_secrets.data_bag(lumberjack_data_bag)
-  lumberjack_secrets.raw_data = secrets
-  lumberjack_secrets.save
-end
-
 # now try to use the data bag
 if !lumberjack_secrets.nil? && lumberjack_secrets['key'] && lumberjack_secrets['certificate']
   node.run_state['lumberjack_decoded_key'] = Base64.decode64(lumberjack_secrets['key'])
   node.run_state['lumberjack_decoded_certificate'] = Base64.decode64(lumberjack_secrets['certificate'])
 elsif !lumberjack_secrets.nil?
-  fail 'Found a data bag for lumberjack secrets, but it was missing \'key\' and \'certificate\' data bag items'
+  Chef::Log.warn('Found a data bag for lumberjack secrets, but it was missing \'key\' and \'certificate\' data bag items')
 elsif lumberjack_secrets.nil?
-  fail 'Could not find an encrypted or unencrypted data bag to use as a lumberjack keypair, and could not generate a keypair either'
+  Chef::Log.warn('Could not find an encrypted or unencrypted data bag to use as a lumberjack keypair')
 else
-  fail 'Unable to complete lumberjack keypair configuration'
+  Chef::Log.warn('Unable to complete lumberjack keypair configuration')
 end
 
 logstash_basedir = node.deep_fetch('logstash', 'instance_default', 'basedir')
diff --git a/recipes/acl.rb b/recipes/acl.rb
index 6ba99ac..49a80dc 100644
--- a/recipes/acl.rb
+++ b/recipes/acl.rb
@@ -11,14 +11,13 @@
 # main point of elkstack, open syslog and lumberjack ports
 add_iptables_rule('INPUT', '-p tcp --dport 5959 -j ACCEPT', 9997, 'allow syslog entries inbound')
 add_iptables_rule('INPUT', '-p tcp --dport 5960 -j ACCEPT', 9997, 'allow lumberjack protocol inbound')
+add_iptables_rule('INPUT', '-p tcp --dport 5961 -j ACCEPT', 9997, 'allow tcp protocol inbound')
+add_iptables_rule('INPUT', '-p tcp --dport 5962 -j ACCEPT', 9997, 'allow udp protocol inbound')
 
-should_cluster = node.deep_fetch('elkstack', 'config', 'cluster')
-if !should_cluster.nil? && should_cluster
-  include_recipe 'elasticsearch::search_discovery'
-  es_nodes = node['elasticsearch']['discovery']['zen']['ping']['unicast']['hosts']
-  es_nodes.split(',').each do |host|
-    add_iptables_rule('INPUT', "-p tcp -s #{host} --dport 9300 -j ACCEPT", 9996, "allow ES host #{host} to connect")
-  end
+include_recipe 'elasticsearch::search_discovery'
+es_nodes = node['elasticsearch']['discovery']['zen']['ping']['unicast']['hosts']
+es_nodes.split(',').each do |host|
+  add_iptables_rule('INPUT', "-p tcp -s #{host} --dport 9300 -j ACCEPT", 9996, "allow ES host #{host} to connect")
 end
 
 # allow web clients to hit kibana on port 80 and 443
diff --git a/recipes/agent.rb b/recipes/agent.rb
index 86ae14c..f9b82e7 100644
--- a/recipes/agent.rb
+++ b/recipes/agent.rb
@@ -61,8 +61,24 @@
   chef_environment: node.chef_environment
 }
 
-include_recipe 'elkstack::_secrets'
-unless node.run_state['lumberjack_decoded_certificate'].nil? || node.run_state['lumberjack_decoded_certificate'].nil?
+# preload any lumberjack key or cert that might be available
+include_recipe 'elkstack::_lumberjack_secrets'
+lumberjack_keypair = node.run_state['lumberjack_decoded_key'] && node.run_state['lumberjack_decoded_certificate']
+
+# default is 'tcp_udp'
+if node['elkstack']['config']['agent_protocol'] == 'tcp_udp'
+  # TODO: udp and tcp senders
+
+  my_templates['output_tcp'] = 'logstash/output_tcp.conf.erb'
+  my_templates['output_udp'] = 'logstash/output_udp.conf.erb'
+
+  template_variables[:output_tcp_host] = elk_nodes.split(',').first
+  template_variables[:output_tcp_port] = 5961
+  template_variables[:output_udp_host] = elk_nodes.split(',').first
+  template_variables[:output_udp_port] = 5962
+
+# if flag is set *and* key & cert are available
+elsif node['elkstack']['config']['agent_protocol'] == 'lumberjack' && lumberjack_keypair
   my_templates['output_lumberjack'] = 'logstash/output_lumberjack.conf.erb'
   template_variables['output_lumberjack_ssl_certificate'] = "#{node['logstash']['instance_default']['basedir']}/lumberjack.crt"
   # template_variables['output_lumberjack_ssl_key'] = "#{node['logstash']['instance_default']['basedir']}/lumberjack.key"
diff --git a/recipes/cluster.rb b/recipes/cluster.rb
deleted file mode 100644
index 80e76a5..0000000
--- a/recipes/cluster.rb
+++ /dev/null
@@ -1,21 +0,0 @@
-# Encoding: utf-8
-#
-# Cookbook Name:: elkstack
-# Recipe:: cluster
-#
-# Copyright 2014, Rackspace
-#
-
-# base stack requirements for an all-in-one node
-include_recipe 'elkstack::_server'
-
-# toggle clustering behavior
-node.override['elkstack']['config']['cluster'] = true
-
-# include components
-include_recipe 'elkstack::elasticsearch'
-include_recipe 'elkstack::logstash'
-include_recipe 'elkstack::kibana'
-
-# see attributes, will forward to logstash on localhost
-include_recipe 'rsyslog::client'
diff --git a/recipes/default.rb b/recipes/default.rb
index 66dc578..fe96e69 100644
--- a/recipes/default.rb
+++ b/recipes/default.rb
@@ -1,7 +1,18 @@
 # Encoding: utf-8
 #
 # Cookbook Name:: elkstack
-# Recipe:: default
+# Recipe:: single
 #
 # Copyright 2014, Rackspace
 #
+
+# base stack requirements for an all-in-one node
+include_recipe 'elkstack::_server'
+
+# include components
+include_recipe 'elkstack::elasticsearch'
+include_recipe 'elkstack::logstash'
+include_recipe 'elkstack::kibana'
+
+# see attributes, will forward to logstash on localhost
+include_recipe 'rsyslog::client'
diff --git a/recipes/elasticsearch.rb b/recipes/elasticsearch.rb
index 7d61a0f..f571a44 100644
--- a/recipes/elasticsearch.rb
+++ b/recipes/elasticsearch.rb
@@ -11,13 +11,10 @@
 
 # do clustering magic, with custom query for our tags
 include_recipe 'chef-sugar'
-should_cluster = node.deep_fetch('elkstack', 'config', 'cluster')
-if !should_cluster.nil? && should_cluster
-  include_recipe 'elasticsearch::search_discovery'
-else
-  node.override['elasticsearch']['discovery']['zen']['ping']['multicast']['enabled'] = false
-  # if the cluster flag isn't set, turn that junk off
-end
+
+# use chef search, not multicast, for cluster discovery
+node.override['elasticsearch']['discovery']['zen']['ping']['multicast']['enabled'] = false
+include_recipe 'elasticsearch::search_discovery'
 
 # find and format and mount any relevant disks
 include_recipe 'elkstack::disk_setup'
@@ -42,6 +39,5 @@
 end
 
 tag('elkstack')
-tag('elkstack_cluster') unless should_cluster.nil? || !should_cluster
 
 include_recipe 'elkstack::elasticsearch_monitoring'
diff --git a/recipes/forwarder.rb b/recipes/forwarder.rb
index 9f3b762..c9ff372 100644
--- a/recipes/forwarder.rb
+++ b/recipes/forwarder.rb
@@ -9,15 +9,12 @@
 # base stack requirements for an all-in-one node
 include_recipe 'elkstack::_base'
 include_recipe 'chef-sugar'
-include_recipe 'golang'
 
 # override logstash values with forwarder ones, ensure directory exists, for _secrets.rb
-node.set['logstash']['instance_default']['user'] = node['logstash_forwarder']['user']
-node.set['logstash']['instance_default']['group'] = node['logstash_forwarder']['user']
 directory node['logstash']['instance_default']['basedir'] do
   user node['logstash']['instance_default']['user']
   group node['logstash']['instance_default']['group']
-  mode 0700
+  mode 0755
 end
 
 # find central servers and configure appropriately
@@ -31,26 +28,29 @@
 end
 node.set['logstash_forwarder']['config']['network']['servers'] = forwarder_servers
 
-include_recipe 'elkstack::_secrets'
+include_recipe 'elkstack::_lumberjack_secrets'
 unless node.run_state['lumberjack_decoded_certificate'].nil? || node.run_state['lumberjack_decoded_certificate'].nil?
   node.set['logstash_forwarder']['config']['network']['ssl certificate'] = "#{node['logstash']['instance_default']['basedir']}/lumberjack.crt"
   node.set['logstash_forwarder']['config']['network']['ssl key'] = "#{node['logstash']['instance_default']['basedir']}/lumberjack.key"
   node.set['logstash_forwarder']['config']['network']['ssl ca'] = "#{node['logstash']['instance_default']['basedir']}/lumberjack.crt"
 end
 
-git node['logstash_forwarder']['app_dir'] do
-  repository node['logstash_forwarder']['git_repo']
-  revision node['logstash_forwarder']['git_revision']
-  action :checkout
-end
+case node['platform_family']
+when 'debian'
+  apt_repository 'logstash-forwarder' do
+    uri 'http://packages.elasticsearch.org/logstashforwarder/debian'
+    components ['stable', 'main']
+    key 'http://packages.elasticsearch.org/GPG-KEY-elasticsearch'
+  end
+  package 'logstash-forwarder'
+when 'rhel'
+  yum_repository 'logstash-forwarder' do
+    description 'logstash forwarder'
+    baseurl 'http://packages.elasticsearch.org/logstashforwarder/centos'
+    gpgkey 'http://packages.elasticsearch.org/GPG-KEY-elasticsearch'
+  end
 
-execute 'build_logstash_forwarder' do
-  cwd node['logstash_forwarder']['app_dir']
-  command '/usr/local/go/bin/go build'
-  action :run
-  user 'root'
-  group 'root'
-  not_if { ::File.exist?("#{node['logstash_forwarder']['app_dir']}/logstash-forwarder") }
+  package 'logstash-forwarder'
 end
 
 cookbook_file '/etc/init.d/logstash-forwarder' do
diff --git a/recipes/java.rb b/recipes/java.rb
deleted file mode 100644
index a39b5f6..0000000
--- a/recipes/java.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-# Encoding: utf-8
-#
-# Cookbook Name:: elkstack
-# Recipe:: java
-#
-# Copyright 2014, Rackspace
-#
-
-# added this for testing. eventually just require wrappers invoke
-# a java cookbook of their choice, or perhaps eventually something that installs
-# java in a 'rackspace way' where customers have accepted the license and
-# downloaded it themselves.
-
-include_recipe 'chef-sugar'
-include_recipe 'java'
diff --git a/recipes/kibana.rb b/recipes/kibana.rb
index 782cc07..4289cf8 100644
--- a/recipes/kibana.rb
+++ b/recipes/kibana.rb
@@ -75,8 +75,6 @@
 end
 
 if install_type == 'file'
-
-  include_recipe 'java::default' if node['kibana']['install_java']
   include_recipe 'runit::default'
 
   runit_service 'kibana' do
@@ -105,9 +103,6 @@
 end
 # end replaces 'kibana::install'
 
-# see https://github.com/rackspace-cookbooks/elkstack/issues/103
-include_recipe 'elkstack::kibana4_workarounds' if node['elkstack']['kibana4_workaround']
-
 # include_recipe 'nginx' # so service[nginx] exists, the one from the LWRP above is not created until runtime
 service 'nginx' do
   action :nothing
diff --git a/recipes/kibana4_workarounds.rb b/recipes/kibana4_workarounds.rb
deleted file mode 100644
index 3e4d444..0000000
--- a/recipes/kibana4_workarounds.rb
+++ /dev/null
@@ -1,24 +0,0 @@
-# Encoding: utf-8
-#
-# Cookbook Name:: elkstack
-# Recipe:: kibana4_workarounds
-#
-# Copyright 2014, Rackspace
-#
-
-template "#{node['kibana']['install_path']}/kibana/current/#{node['kibana']['file']['config']}" do
-  source 'kibana.yml.erb'
-  cookbook 'elkstack'
-  mode '0644'
-  user node['kibana']['user']
-  group node['kibana']['user']
-  variables(
-    index: node['kibana']['config']['kibana_index'],
-    port: node['kibana']['java_webserver_port'],
-    elasticsearch: "#{node['kibana']['es_scheme']}#{node['kibana']['es_server']}:#{node['kibana']['es_port']}",
-    default_route: node['kibana']['config']['default_route'],
-    panel_names: node['kibana']['config']['panel_names'],
-    request_timeout: node['kibana']['config']['request_timeout'],
-    shard_timeout: node['kibana']['config']['shard_timeout']
-  )
-end
diff --git a/recipes/logstash.rb b/recipes/logstash.rb
index d714d10..fbc3520 100644
--- a/recipes/logstash.rb
+++ b/recipes/logstash.rb
@@ -27,8 +27,11 @@
 end
 
 # by default, these are the inputs and outputs on the server
+# we receive anything from any protocol we might know about
 my_templates = {
   'input_syslog'         => 'logstash/input_syslog.conf.erb',
+  'input_tcp'            => 'logstash/input_tcp.conf.erb',
+  'input_udp'            => 'logstash/input_udp.conf.erb',
   'output_stdout'        => 'logstash/output_stdout.conf.erb',
   'output_elasticsearch' => 'logstash/output_elasticsearch.conf.erb'
 }
@@ -38,10 +41,15 @@
   input_lumberjack_port: 5960,
   input_syslog_host: '0.0.0.0',
   input_syslog_port: 5959,
+  input_tcp_host: '0.0.0.0',
+  input_tcp_port: 5961,
+  input_udp_host: '0.0.0.0',
+  input_udp_port: 5962,
   chef_environment: node.chef_environment
 }
 
-include_recipe 'elkstack::_secrets'
+# also receive lumberjack if a keypair is available
+include_recipe 'elkstack::_lumberjack_secrets'
 unless node.run_state['lumberjack_decoded_certificate'].nil? || node.run_state['lumberjack_decoded_certificate'].nil?
   my_templates['input_lumberjack'] = 'logstash/input_lumberjack.conf.erb'
   template_variables['input_lumberjack_ssl_certificate'] = "#{node['logstash']['instance_default']['basedir']}/lumberjack.crt"
diff --git a/recipes/newrelic.rb b/recipes/newrelic.rb
index 01478a1..a787e13 100644
--- a/recipes/newrelic.rb
+++ b/recipes/newrelic.rb
@@ -8,7 +8,7 @@
 
 unless node['newrelic']['license'].nil?
   node.default['newrelic_meetme_plugin']['license'] = node['newrelic']['license']
-  if tagged?('elkstack') || tagged?('elkstack_cluster')
+  if tagged?('elkstack')
     node.override['newrelic_meetme_plugin']['services'] = {
       'elasticsearch' => {
         'name' => node['elasticsearch']['cluster']['name'],
@@ -23,13 +23,6 @@
 
   user node['newrelic_meetme_plugin']['user']
 
-  include_recipe 'python::package'
-  include_recipe 'python::pip'
-  python_pip 'setuptools' do
-    action :upgrade
-    version node['python']['setuptools_version']
-  end
-
-  include_recipe 'python'
+  include_recipe 'stack_commons::python'
   include_recipe 'newrelic_meetme_plugin'
 end
diff --git a/recipes/single.rb b/recipes/single.rb
deleted file mode 100644
index fe96e69..0000000
--- a/recipes/single.rb
+++ /dev/null
@@ -1,18 +0,0 @@
-# Encoding: utf-8
-#
-# Cookbook Name:: elkstack
-# Recipe:: single
-#
-# Copyright 2014, Rackspace
-#
-
-# base stack requirements for an all-in-one node
-include_recipe 'elkstack::_server'
-
-# include components
-include_recipe 'elkstack::elasticsearch'
-include_recipe 'elkstack::logstash'
-include_recipe 'elkstack::kibana'
-
-# see attributes, will forward to logstash on localhost
-include_recipe 'rsyslog::client'
diff --git a/templates/default/logstash/input_tcp.conf.erb b/templates/default/logstash/input_tcp.conf.erb
new file mode 100644
index 0000000..c121d28
--- /dev/null
+++ b/templates/default/logstash/input_tcp.conf.erb
@@ -0,0 +1,12 @@
+input {
+  tcp {
+    port => "<%= @input_tcp_port %>"
+    host => "<%= @input_tcp_host %>"
+  }
+}
+
+filter {
+  mutate {
+    replace => [ "input_chef_environment", "<%= @chef_environment %>" ]
+  }
+}
diff --git a/templates/default/logstash/input_udp.conf.erb b/templates/default/logstash/input_udp.conf.erb
new file mode 100644
index 0000000..753708c
--- /dev/null
+++ b/templates/default/logstash/input_udp.conf.erb
@@ -0,0 +1,12 @@
+input {
+  udp {
+    port => "<%= @input_udp_port %>"
+    host => "<%= @input_udp_host %>"
+  }
+}
+
+filter {
+  mutate {
+    replace => [ "input_chef_environment", "<%= @chef_environment %>" ]
+  }
+}
diff --git a/templates/default/logstash/output_tcp.conf.erb b/templates/default/logstash/output_tcp.conf.erb
new file mode 100644
index 0000000..38f005d
--- /dev/null
+++ b/templates/default/logstash/output_tcp.conf.erb
@@ -0,0 +1,12 @@
+filter {
+  mutate {
+    replace => [ "output_chef_environment", "<%= @chef_environment %>" ]
+  }
+}
+
+output {
+  tcp {
+    port => "<%= @output_tcp_port %>"
+    host => "<%= @output_tcp_host %>"
+  }
+}
diff --git a/templates/default/logstash/output_udp.conf.erb b/templates/default/logstash/output_udp.conf.erb
new file mode 100644
index 0000000..09263de
--- /dev/null
+++ b/templates/default/logstash/output_udp.conf.erb
@@ -0,0 +1,12 @@
+filter {
+  mutate {
+    replace => [ "output_chef_environment", "<%= @chef_environment %>" ]
+  }
+}
+
+output {
+  udp {
+    port => "<%= @output_udp_port %>"
+    host => "<%= @output_udp_host %>"
+  }
+}
diff --git a/test/integration/agent/data_bags/lumberjack-auto/secrets.json b/test/integration/agent/data_bags/lumberjack-auto/secrets.json
deleted file mode 100644
index b5e77b7..0000000
--- a/test/integration/agent/data_bags/lumberjack-auto/secrets.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "id": "secrets",
-  "key": "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRRGdhQXArYkdpa2JKbDQKOU5OMzVLRTdhQkJHYStJcjdicVdxSlB1MVR0VVJadEVnYXNOQ0pZOG9NT3dwSzUweFQvNlBmM2VLK3Rsb1BFbwp0TGxzZlF0SlhIdG5EUlRmQXlFcWI0OUNYWm40RTNtR1B0WmpETGpVUVcva2p2OXhneDVrNzhFdWJXZEVSc090CkVxMi81ak1HVytDam4yVVNZM3ZnSzlXR2FJdkRGUUJhbXI0WFo2Ynl5MkFpZHgwTG9vOEJvQXM1N2tneXM2L3AKS2NLUEZKM2s5aUZlTU5aZ2hOVWkyakdBNXpWMkpRdzU5N1h6NWw0WkhGeHVxL0QzTFREWmNtcGRuQ2k3djRNWApCN2ZFNXNsNTZrZnBNajJqc0RGdVRXTWlPdzBhRkdnQjhuSkloeVZxZVNtUktQWG1ad0pPZVByS0s3em53RVpaCk9NRitqbG5QQWdNQkFBRUNnZ0VBSU9ZZjQ3ancvbW9OZGZZdXFuMFNSaXRUZDMrSmdQY3hTN1ViT3dCMzJqcjYKTUdqeU1zNzNkNXY2RklPUUwvNWJDc3piMHg2TlBERUVLZnVVMDVyaGRMZmlQNUZqWmU2SGhqa2t2NDRKYkowdQpTOGdhbGhyZlhmN1o4S0FtUXZYK0ZyNHZqQ2J0NU15YkUxeVJySGlMTW50MXk0Y3F3aTlqa2RIYlZBRXZ2RUdwCnBkczZuVjR0aGwvOHJjb3kzc0dXZEdGMWl4UzVaeFNlbVhOb2Znc3pZbGZRZVZEN1BqazBPMU9VeVJYc0VqTGEKM2ZlbFJSeG52RGZ3QjlURlo2ckVjL0tBUzZwQSs2Tm1SV3lMZThITElHamlzSzArbFUwV2t3U0daUm0yaDhZWgprQWFWNGFxb3J1MHgwT0FpTjRYVFQxUlpmSnZiUEVYcHkwK1ZrbGtLZ1FLQmdRRDJQRGMrR3NId001ek9mNTNyCmFkVUdlV09YQllOam5pS1hCZDZialhxWWdHMGhBWlhwVTd5SFhFVnFDSXpiQTlGdndNS3BiOXAzNGE5N1oyaTUKK3JkRTU3ZzVaT1ZhazBQc2RnRDlDUW9YTld1ZU54RFJFNU45dmhjTEtoN1BlNXBLYU1BK1lrN1VhZ1N4T1dHWQpLMmhBeHRrZTdlUWlyQlNER24vL2RDU3F1UUtCZ1FEcFRqZ0E3aUd4Z24rektTcWFEWXAycm1Td2FDZHFqY3hxCmsvSTI5RW1ma2RvamdKYjN1cGxZR1lEejVUUVBvQzhHMFBYZVdQSEQ0YjdVcStkckYxQkw1Z2dYM2pjQVRrN0cKV3B3Z25UMS9zT0pXVDNEemJEUkNTV04rdUYrMjNYS2VtNGx3YmNYS0NDOWpTcmx0dWUyZ3g1U0tNa0NTamxoQgowNjVLTWhqRXh3S0JnUUROQmNaWmg1NERpblg5Mm5SN0YxdXdVRktENUt0SnZ0bStOYnpzZUJpajhncnJlSTZDCkFKN3hkZnEyRnZoeFEvU1d3RUZWSXpVY3JHV1lzcm1ZWVJGSDVraVdRVlJXM2xlb0Ezay9OcytZRTNyUCtibWUKM0ZYcVZPU0svejg0TXdwOCtrdFhwak5NMmhtZUZ0RVVDdEI3WHhaWmttcHFGQzNnRzZpSDR3VEV3UUtCZ0dUNApPQjZXOExnTkhVMGhkTkdGS0xhaVZPdFB1RGRTTlBTdklMV04xY3NjYVViU0lRUUhtdFBZL2NrUUdnN2xLVlVPCjNFbWxQc1NpajE4bElwdGpWSm4wYk80L2VwaEVTNjFtaTRsRjQ5YSthOFlreldKY0l1WEpNeWtsakM3cytlMFEKclZPZC9tcW9Uakh2cGY2SjZBQ2NQM25yczZ4NXRGS1ExUzVCTGgwREFvR0JBT2FxaHdYeWYvQkNNTjBYaVdtLwpKbGZRM0ZFeThJRVE2alZPaXZ3NFlENlVkZ2FPWW1EdGtaakYwUjNGa2FQRmJqalhhRHY5N0JyaW11THJieWZpCjRrY3BzMDJESSthR3RURE5uclRsNk5OazdJY0NSc2w4UTZqcVdmVEJrM3pMdTM2VXpWN1dQYmx1MG1SY1dkeEMKSTdudjh1UGkyVXZmMkNlNTdNclNWL1lQCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K",
-  "certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURwVENDQW8yZ0F3SUJBZ0lKQU0xQm5BenhxWWdmTUEwR0NTcUdTSWIzRFFFQkN3VUFNR2t4Q3pBSkJnTlYKQkFZVEFsVlRNUXN3Q1FZRFZRUUlEQUpVV0RFVU1CSUdBMVVFQnd3TFUyRnVJRUZ1ZEc5dWFXOHhFakFRQmdOVgpCQW9NQ1ZKaFkydHpjR0ZqWlRFUE1BMEdBMVVFQ3d3R1JHVjJUM0J6TVJJd0VBWURWUVFEREFsRlRFc2djM1JoClkyc3dIaGNOTVRRd09URTRNVGt5T1RJeldoY05NVGN3TmpFME1Ua3lPVEl6V2pCcE1Rc3dDUVlEVlFRR0V3SlYKVXpFTE1Ba0dBMVVFQ0F3Q1ZGZ3hGREFTQmdOVkJBY01DMU5oYmlCQmJuUnZibWx2TVJJd0VBWURWUVFLREFsUwpZV05yYzNCaFkyVXhEekFOQmdOVkJBc01Ca1JsZGs5d2N6RVNNQkFHQTFVRUF3d0pSVXhMSUhOMFlXTnJNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE0R2dLZm14b3BHeVplUFRUZCtTaE8yZ1EKUm12aUsrMjZscWlUN3RVN1ZFV2JSSUdyRFFpV1BLRERzS1N1ZE1VLytqMzkzaXZyWmFEeEtMUzViSDBMU1Z4NwpadzBVM3dNaEttK1BRbDJaK0JONWhqN1dZd3k0MUVGdjVJNy9jWU1lWk8vQkxtMW5SRWJEclJLdHYrWXpCbHZnCm81OWxFbU43NEN2VmhtaUx3eFVBV3BxK0YyZW04c3RnSW5jZEM2S1BBYUFMT2U1SU1yT3Y2U25DanhTZDVQWWgKWGpEV1lJVFZJdG94Z09jMWRpVU1PZmUxOCtaZUdSeGNicXZ3OXkwdzJYSnFYWndvdTcrREZ3ZTN4T2JKZWVwSAo2VEk5bzdBeGJrMWpJanNOR2hSb0FmSnlTSWNsYW5rcGtTajE1bWNDVG5qNnlpdTg1OEJHV1RqQmZvNVp6d0lECkFRQUJvMUF3VGpBZEJnTlZIUTRFRmdRVXVwclZZd2Q3aG8zaUxCWWZudkVaUUw3Wlo4b3dId1lEVlIwakJCZ3cKRm9BVXVwclZZd2Q3aG8zaUxCWWZudkVaUUw3Wlo4b3dEQVlEVlIwVEJBVXdBd0VCL3pBTkJna3Foa2lHOXcwQgpBUXNGQUFPQ0FRRUFzRzJEYXFOREt3T1VPbWJYRnhWeWlEVWJFaG9uTUkrRXgyM3Brc2FqUnNMdVJBQVpiSDY1CkVHQy9Rb1dkVE5BSkVFSzdVeVRmMVk0VENHU0Z5KzZ1TDRMRWNEREtlTWRJaEJIcEdXM2FocnVwcW8vNDR2OEUKTm1iTmcvWklkUXBZYjJZcHVlcjdPRDVGaGI5aVFxc2tuRzRJcTR5dC9zR3hLSEdmNktQY3c1dkJxK3BWTFVidwpSczczVDhINU5XKzduUUNZS1RSVU92dGY0SkgwbXEyMW9Yd0VvK2JGUHkrNVhPQitqVExtVnN4WWhnU1R6Z3h1CjhqTUpiNnhzSzJPVUdpcUl3a0ZsREdqVmluN3Rlb2JReUpzQklaaEptSXVkT0FIdU9jQ0VrR3c2SUJuaGpoUmcKaEg2djg0V0lIQ2tZeVZlb2dRWGkwWnRtbEt4NVk4SDh1QT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K",
-  "something_else": {
-    "encrypted_data": "5b9+5rnFy9nm9mS4pjzgK5fkkaGGV1y002xGHhDVQ71wiMweg72D4PWrqv9a\nmuLvGQt2qHED/WefroHg+EaUnEJPdMjNms/vOvnXDEOqdvUkLUcGfscUuQyM\nItz+aIbFohAQUvpICTmF+wVRmAdVWcpcwwr9Wav+2MoKZQze5aRoQSrk7eyh\nWkeVi+i4Ba4NAo8sRhvienmtYqGREcGF24WTzGu7BpdOnJyLepWNKyWB8f+q\nRRALhGbHALBIwrma3DvdjR+X+LMFtSQ+D6weRI9x1se7tPL49DyGTSnLtmfh\nouSlrc7mbb4sebp7ArjIfOMf39BfYN++VCF07M1o2qQ91Bz+oBTqtE4b3ktA\nzjKPCQg7HnzO/HF627F44JkxUQW2HrsOc1S998ABEPn5nuRS3OSJsw25P/Nh\nmK/QWtAAxat36QBzGNoPPQxqdLWxN1Jb9La1Q4/jWgUJ4q0LwcUk3G2FGdtg\n+O0XPfKID5o2i9+R9/T5vTKRY+8+/H1/OEEOgNPwj1Fjo7degyAHJolzQbHe\nIDcGB+YlTmFChD2nCypHbVAGpqpLvKR1WhiKVCjYF+wOFiSX8Ph/8WG/6OeD\n4MUzAj1Zqos6GQ0syhLg/Rixn8v0bBTqiB8NvYbch4X/ryI+9KtutWdy2Q6D\npK/2Plkte6yrx611lQrorVTaLQCAt5ybAHcqnWXbV0eWMGE0QorWcJMcY0rb\nHMde48s2M1/OAoxnYAm6RUaLokvkAmXiuHc7IGPzrD4fSXwFBZshRYev4InX\nLK+Ut4e6eNsre9QYYfqJddmzEw86wfmurRK5SmeRsxjPCc8pwBhYxckqVVUn\n9yvhD8yMqMqylEJmtyxaVFNFW7Ih+cxE/+nWLPdDuM74/iNq7kY+gzeSz+qu\nnST4HpSkDNFwMDB7AYYKaAkuovrYOKtvfePUpEZDmZOkgon+dBVQsC9ikiS+\nF+aKPiXAE1PDvKDPTZ1RyFyE4jEW9HZ6jjtJyXEvkTcPsXI28LieDmuFc5VI\nP04PLGh8tYNO0R2XqR3TOQ2/z21e4OfCnLVUnH8muBNwCi7KyAC+bKEDTwpM\nIp5ByldOu799ejbDBTMvNXD7t8C+hhP0wsITuJOAUw7R035/BHcouCc8t0d2\naRVfquKuflMY+5ezhgWdjDgU7LI5X1K/VWrK9iGWyYv399a1quvwEYeG0yDv\n1IwfRdTkRty7qV2smO35VrhuxwzDO8lKS5DWkA3caXvFqQecU2woWVL3E+rM\nxvDj09GG9CORfnmu4mW1Zli4HoXnCZtWPeHIRayGeCP81yVogI/GgB9TyQr5\n+DkkOCGOHfSDWZv/19Nvus7ahyLl0Ti5z0/PytM02vCDs1yLLzpfqFZOf6Ou\nzMkN66cwerhcFW1qzoP8SxCNYi51RUEmD1DeMJFEB88bC51zNn/cmxphG09p\nmLTmHNSvq4Qop/O8EiKpMm0X88zyMkonMqeHqCr488mlnPd4oy5E8pavmmXl\nUKH8iJSNI8eBquLog1xZ8wzw7ETo4Zn9us5p8pLqebmlQCXGWqZKdhaNO1TV\nQjG7rVZamP6EkEokqtjsv16JCyKsxL3fazSDXpT1Q68vugKdlQo6kfVdDjPM\nJb9BFZCjCCa9OyHfq2hdh/0C9P1uLYaQi2ZV0ZBgPFFxmRL3C735R3BRc9Wx\ng+5t9PAtyde2ONNjhIdpZDDSD7IRsuAdbNNxaBKZkly84Y+g56lToUMi7rPc\nAWnA2xeIdzaicAFNBwOyJZWbNNgeKUssC70L+xNy2fbW5D4mE2laNIqjiFkX\nkUSAivLAfM7ges8O2CBk1GRLwX1X7M9M+DIP3YP5BDfMT5D1B5iQYTf7uOe1\ne+gUNTzw757TBwcdnM7gChStXhu6CAKBiBnMReTm7pur/g7CXxUjrKkHVjw5\nx1tY+SlWFzBjZR4Q3gCk82ZNnbiPdnAQUdpYgLoixxxka/WZcg4AdtkQADsZ\nydAEAEcg7pvqXn/pBOxcK+T77G48ecYZE8W4bqecHSROwaqwOxChRzME6ZK1\ndc/3/4YG15MXyCoHfkC1D6QU98hhU9EoBmsiQ1Y1KasixxGHYFAHtzR7aTIE\nJ1C/h70KAfVUvFG8h6ssJutc+ErdleB77MtSSPAzHCPrnIDurzRZahk8sGbv\n8TOV6IPA2V5LvDV7m38MSuZVIZrtTu4DE+lvRbUNVK+5mv8Wnd+j6Ole59M2\njCRPg+8jWCJrdaMD6OKuWeC2W7YH16gDVMFD1o4AWGM1s+9xBQUiPnWnVpQC\nNhd+bG0mGJ/Q11kRqtur8cz4OV2LHtct32Z7L20tsJxwXCkjD1ZqaUnwFhxv\nDrlsEUoZG0nMCiIBhsXry45or9416B3qpASlZRYFEEccxdvhKg==\n",
-    "iv": "mzYA25XJz8h/KdoPowygEQ==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
-  }
-}
diff --git a/test/integration/agent/data_bags/lumberjack/secrets.json b/test/integration/agent/data_bags/lumberjack/secrets.json
deleted file mode 100644
index 7d31128..0000000
--- a/test/integration/agent/data_bags/lumberjack/secrets.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "id": "secrets",
-  "key": {
-    "encrypted_data": "qYdZnJGfGGS7ZvacB6bRgp6doeEdjkFoXgZGhjdGoo5uNph3vZSRJrf7lC6X\nYCXZTHsqG+Ac9pJiix/KAEemX2NsXpHvpj2i7w0klJH9aSeWw8dfxf4G0tNa\n9Gw0oU8F1VoDaBPLD21yKFwZKmyefVXG2hwCZHa0U8QDCigSA2AmUtHS8CGO\nDIDOCdADhalyVjDmWjtBt3g2jnhodaIdRB7gBgtL3TP9qZpMP/igrw6PWKm3\nvekCr4S4np/SKAJuqWihpXLudkCoNSypxeAiaGG4SrgUbK/n1pJyOfRMxwSt\ngi2D5t61OKfhj9dob5IgYfsvdPULaO1qBJS1km2ITOi8Y0n01Z8wKB21ytjU\niRcQuq4zu3rMj2pF3k1TWjEevNIN3cFHIcA9fgEq2d5oRGug6KNojydVdqvE\nKVoLYXb1k7bTTzKmoNlEyFUZQEtk5aNA1mErahFzAkylMYuQLeKvlRO3qo9/\nVDDkeFmyVKMb4xK1rfsp1SGpPkZF0NyoMgUHFMvL3F7t+TgwS3PWUNtc6MY3\nNtKo/2PKzmpIn3tolPLl9Ch5rjC6NkHu+10BZTy9WvtAaxMY0vGfDGy3h4N2\nk8WjU70oxSiHulRzw+pww1PEcpJ84K0sF4HsKku9vfGocSbODCbcvVL7j+zc\nshICmaZbroVuYXNGuj5MuNggsxC5zBF0nKpy4b0hQ0waotsqUtSDgvnMkems\nQeHTYbcAKTy8qTMF8vz7q/8UKgC2lc2D5G28EFiti/qLN4higkTTrO75Tx6z\nGHrEQjradFNRNr4yHLdg36IljeRc21uPrOEP68rEYF6Nmby/Z5OhNCLWvFfD\n/mr13YxIiB+2hi8Hw4/smNXChu6LOwxFbguYgj74gv91RxTI0m0ld4doBeiL\nVvqZlr3cbwa4OvjDWl3cM4mPWmlTnJUfWxiqKw9lTfYggO9v3ZYgqu+kS9+d\nLwMnJ7QCTGZKJnrW/g9pqIs4BySprmgJuMY2DcgWfMWqhFnWLVbQOZIY9vNj\nBauSUnOKh6YK+/c2MN8cl2aBRHd23CoZGz6poEmP5AQpOhYHdCRLxjF4Exv9\nu7AoP5ygx5Y6+i1981xAbKAptizln21y3TTBbH+QmrybwJvE4pzCbtb62GDw\nRkyQmyixmY0BDUtylyRH0yxgnQIzWnE61Mx5nrpdu0CZmswic145Gnyzjh/a\nVdt8YovHGHtI4+CcEoyhjo5EmEEaLJ3/KQCzB8CRLSkhBRE9dCwq7Hymfaw0\nrRpdfZj+aEkzZDQy7MK01VO5/9bANkCuiuIw7HRuxzsM1BsrrCQGWfWqakfR\n8htmDl2inG7oGnZ9s15WhiSN5AxvWvl5EZEQ5ln5gRLNwbami6WaPmvEd4zl\nxc5pWyf80gyrrJjdCqHAzf7hI5Vbnm8Z14c6Zfa14brk0yToCi1MkU5ZlwTG\nEaG+6LBnkKpacqkAB8McDlLZ6FatTNDMwssZdJg1VXaTnS7+U/F3FyB2uxBC\n5WuSwZAJuCmQzSTBxPAc20PrdLq8l5O7QKlat38GkYJ/IX19Kr4EFw09MgpA\ndd9vwMvy8BnwDxKwwBVAVypAv2SHhOsnkMkM9eA0+51zbiawi/8zkUzY8rPT\nLOpwO1kTLXt1cVZoF2tfHskEwB0ueUKuOXyPPfoqXyRW0yzx1PVyWlizjvkY\nZL8TxwRkIXhZrWpE5ReGdyYdjAMj8MEKKzbJFYKEnoWFoAGFoSQVtZmtHlF+\nJcxs6cs4jH+AhMfbxk1FwqlbdD7IjUrkcJdtI7FYkDXxSi0xA2Oap/81uoQk\nf5hgJiEvvflOAbjagQd662l6pqajTjYPmAL7vZFj4qWtzew4PhRGf9+mhax7\nra/zSgPzMT3C7lDvhTbRfz6ZP9dKaHBit8rJ8fUdQ+VrnFhQkaFVRG2W4URG\njX4WHWsyrtfTncKRRq63BPsp6LRzvQdc6kgPyhGwAUjmMOJ1pmKGfLZzZTEk\nPjmMIwWJIR1vCM5Uoa5S9fPVonFEbjuZWR1CmgOYBaB4qWfmd3IXIT92Gv4K\naHMjm91MCJ4W5oY8ddyo9MKJpP+/t3F1cFR9N8dbKDvsSBJuMDC4giCTNqUH\nBe9LrThVpNY5uEqcu3F6Z4gbaZQPfouNjKVQp4hrYUDHF87jslleZRmQDQxL\nfiCAghNxEP6vAfbs2Iq2Tf6Kc8w3w9qViBWYUdvnn3kkp9SNht4gxs8Ga2d1\npAuQ/oRN4mzPQI42nkvRujNo/txm+F7RefQAaHJT4KuhxYfoxzN0ljeBYH8i\nG8wbNqkhdWtH8qk1fR/1XdaxTcIBtXh2e3z8nn2TWNihwrVjN9l8SJraoeJZ\n7+tYDz0a7kiCWsDRDveei9oVgDkiAcCwxhDFe98Vpd5FWPTLbIkpUUsX8rRC\nrNbx1EaKMUuU5voQQxXNwKXizA0xsLi540jMUYMK78PvQcEqHJ2vkg6BzmBh\n9bjOipYTwZ9aXnlin+lX3ixHCq2BZwQ0FfhIfGERw1mQ0NOcRHUNYNHALju8\n7V+a+M8sZuaStQcVZhn7XMNb+cafX7ngYU5XBgGSN/r7s6y+2XEwFzlBzDhw\nQgq9DoWwxLFu6A2NknpF2GRif2q9Yk/ajXCnta/sK0T2kWFPnCmP5X24w3Rx\n66oGketvYo9BxSEfCCzOBRy1KRhbMerRvSlnEcHLNnQZb8A3lP1bfTvKHqWj\nmVH2jjTSspZUnxPOfFMq9YETJFVFzHmtTXa3XeS7Ml/QooPxD1IyGiEX+4Bp\nY6iyxiOitiGvo4KHSvWMY9TMUgWC8ePmJ57Np/2GdTcgBomc+TGAuHj89IGq\nPP+X9Y8P+8OLtw47JSUWGzxFYl/YgYDPdFkrlr/84C+iYcWnqPeHNxqUgint\n2hwIZHHBtiEc+i5vDghmNnWRf1zsOnIl9arEaIBFQzrkZ8kft3ZklA7BAzCO\nppNH46UYaej1fhwAoSZl+NlOOW4nXK7hWZ+dLH2cvfqyNBUsFzGXqr+TJ+dp\nXShepBbZkBjpmx78IKwm0x8ZasaXQpU3ohoydgzayv9x0U0fYKdHAA5viF6I\nKivEfeRNojEi\n",
-    "iv": "XR/665QEKxD9eJOVTfcMtg==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
-  },
-  "certificate": {
-    "encrypted_data": "5b9+5rnFy9nm9mS4pjzgK5fkkaGGV1y002xGHhDVQ71wiMweg72D4PWrqv9a\nmuLvGQt2qHED/WefroHg+EaUnEJPdMjNms/vOvnXDEOqdvUkLUcGfscUuQyM\nItz+aIbFohAQUvpICTmF+wVRmAdVWcpcwwr9Wav+2MoKZQze5aRoQSrk7eyh\nWkeVi+i4Ba4NAo8sRhvienmtYqGREcGF24WTzGu7BpdOnJyLepWNKyWB8f+q\nRRALhGbHALBIwrma3DvdjR+X+LMFtSQ+D6weRI9x1se7tPL49DyGTSnLtmfh\nouSlrc7mbb4sebp7ArjIfOMf39BfYN++VCF07M1o2qQ91Bz+oBTqtE4b3ktA\nzjKPCQg7HnzO/HF627F44JkxUQW2HrsOc1S998ABEPn5nuRS3OSJsw25P/Nh\nmK/QWtAAxat36QBzGNoPPQxqdLWxN1Jb9La1Q4/jWgUJ4q0LwcUk3G2FGdtg\n+O0XPfKID5o2i9+R9/T5vTKRY+8+/H1/OEEOgNPwj1Fjo7degyAHJolzQbHe\nIDcGB+YlTmFChD2nCypHbVAGpqpLvKR1WhiKVCjYF+wOFiSX8Ph/8WG/6OeD\n4MUzAj1Zqos6GQ0syhLg/Rixn8v0bBTqiB8NvYbch4X/ryI+9KtutWdy2Q6D\npK/2Plkte6yrx611lQrorVTaLQCAt5ybAHcqnWXbV0eWMGE0QorWcJMcY0rb\nHMde48s2M1/OAoxnYAm6RUaLokvkAmXiuHc7IGPzrD4fSXwFBZshRYev4InX\nLK+Ut4e6eNsre9QYYfqJddmzEw86wfmurRK5SmeRsxjPCc8pwBhYxckqVVUn\n9yvhD8yMqMqylEJmtyxaVFNFW7Ih+cxE/+nWLPdDuM74/iNq7kY+gzeSz+qu\nnST4HpSkDNFwMDB7AYYKaAkuovrYOKtvfePUpEZDmZOkgon+dBVQsC9ikiS+\nF+aKPiXAE1PDvKDPTZ1RyFyE4jEW9HZ6jjtJyXEvkTcPsXI28LieDmuFc5VI\nP04PLGh8tYNO0R2XqR3TOQ2/z21e4OfCnLVUnH8muBNwCi7KyAC+bKEDTwpM\nIp5ByldOu799ejbDBTMvNXD7t8C+hhP0wsITuJOAUw7R035/BHcouCc8t0d2\naRVfquKuflMY+5ezhgWdjDgU7LI5X1K/VWrK9iGWyYv399a1quvwEYeG0yDv\n1IwfRdTkRty7qV2smO35VrhuxwzDO8lKS5DWkA3caXvFqQecU2woWVL3E+rM\nxvDj09GG9CORfnmu4mW1Zli4HoXnCZtWPeHIRayGeCP81yVogI/GgB9TyQr5\n+DkkOCGOHfSDWZv/19Nvus7ahyLl0Ti5z0/PytM02vCDs1yLLzpfqFZOf6Ou\nzMkN66cwerhcFW1qzoP8SxCNYi51RUEmD1DeMJFEB88bC51zNn/cmxphG09p\nmLTmHNSvq4Qop/O8EiKpMm0X88zyMkonMqeHqCr488mlnPd4oy5E8pavmmXl\nUKH8iJSNI8eBquLog1xZ8wzw7ETo4Zn9us5p8pLqebmlQCXGWqZKdhaNO1TV\nQjG7rVZamP6EkEokqtjsv16JCyKsxL3fazSDXpT1Q68vugKdlQo6kfVdDjPM\nJb9BFZCjCCa9OyHfq2hdh/0C9P1uLYaQi2ZV0ZBgPFFxmRL3C735R3BRc9Wx\ng+5t9PAtyde2ONNjhIdpZDDSD7IRsuAdbNNxaBKZkly84Y+g56lToUMi7rPc\nAWnA2xeIdzaicAFNBwOyJZWbNNgeKUssC70L+xNy2fbW5D4mE2laNIqjiFkX\nkUSAivLAfM7ges8O2CBk1GRLwX1X7M9M+DIP3YP5BDfMT5D1B5iQYTf7uOe1\ne+gUNTzw757TBwcdnM7gChStXhu6CAKBiBnMReTm7pur/g7CXxUjrKkHVjw5\nx1tY+SlWFzBjZR4Q3gCk82ZNnbiPdnAQUdpYgLoixxxka/WZcg4AdtkQADsZ\nydAEAEcg7pvqXn/pBOxcK+T77G48ecYZE8W4bqecHSROwaqwOxChRzME6ZK1\ndc/3/4YG15MXyCoHfkC1D6QU98hhU9EoBmsiQ1Y1KasixxGHYFAHtzR7aTIE\nJ1C/h70KAfVUvFG8h6ssJutc+ErdleB77MtSSPAzHCPrnIDurzRZahk8sGbv\n8TOV6IPA2V5LvDV7m38MSuZVIZrtTu4DE+lvRbUNVK+5mv8Wnd+j6Ole59M2\njCRPg+8jWCJrdaMD6OKuWeC2W7YH16gDVMFD1o4AWGM1s+9xBQUiPnWnVpQC\nNhd+bG0mGJ/Q11kRqtur8cz4OV2LHtct32Z7L20tsJxwXCkjD1ZqaUnwFhxv\nDrlsEUoZG0nMCiIBhsXry45or9416B3qpASlZRYFEEccxdvhKg==\n",
-    "iv": "mzYA25XJz8h/KdoPowygEQ==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
-  }
-}
\ No newline at end of file
diff --git a/test/integration/agent/encrypted_data_bag_secret b/test/integration/agent/encrypted_data_bag_secret
deleted file mode 100644
index 82d55ee..0000000
--- a/test/integration/agent/encrypted_data_bag_secret
+++ /dev/null
@@ -1,11 +0,0 @@
-EmdGXZrS810mG1PlyxcYvWgwLR0BwcDspQRgRuR7QNcEl0eW27WAB8tqn9VPdbFr
-2Uj3fhj0z2Hg/iMbbQ027yT+i95SORdn8DS0j6ZUIqrpSCqJpDdQzc9eApdilWXC
-KkzH6n8KsgK7QlmHwdLGTpMNF23ebrZsdQ6ptrlvEx+lvedHEWR9KJ/NNQzgqx7O
-BO9LQ6bQW0XdpnMoZd9+oPzyPEu3T9pXVvneE0lpGcI2xp4feeyLS3OHVEngMo6M
-kfj0FaxdM9W+Wdl+2XXa2Zu50xHfzo0B/QU6jJv5Un6XenHAQ9WbS3oVyI+kT7SJ
-wfUPC5Dm0/TBFFauqxUCWY+mYv2h9MO6jiH9m9FCz1g2v0yn+WeMX5VnHMaJwf9E
-l19b/Ls+OJp7SklBH6v0aq3YhxFZR56g0+ujHnl4jKwaIi2dSzoVyvKSFySW0Wn0
-e3LFkiNv6reoQir3rBj7uzofYiM8XFexXIZq2r50Q9KyzErS6X2IrMwssupE5zx6
-rodFCIazq7OGz4Py+cq+A5qdPLz/d3erhCViJz4LwcXolwg4HpdWuAR0CDweGoRs
-h9PpquaT0q2J5cxvh50pEUulCMy07u2y4eUD/RMtMyl2QL96QBoL9KVNe8EpkAqc
-v9/kQM15tvmfnXJZJTvqyxdpJoUz471SV6sj5m12+y0=
diff --git a/test/integration/agent/lumberjack.crt b/test/integration/agent/lumberjack.crt
deleted file mode 100644
index 3e1353c..0000000
--- a/test/integration/agent/lumberjack.crt
+++ /dev/null
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDpTCCAo2gAwIBAgIJAM1BnAzxqYgfMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNV
-BAYTAlVTMQswCQYDVQQIDAJUWDEUMBIGA1UEBwwLU2FuIEFudG9uaW8xEjAQBgNV
-BAoMCVJhY2tzcGFjZTEPMA0GA1UECwwGRGV2T3BzMRIwEAYDVQQDDAlFTEsgc3Rh
-Y2swHhcNMTQwOTE4MTkyOTIzWhcNMTcwNjE0MTkyOTIzWjBpMQswCQYDVQQGEwJV
-UzELMAkGA1UECAwCVFgxFDASBgNVBAcMC1NhbiBBbnRvbmlvMRIwEAYDVQQKDAlS
-YWNrc3BhY2UxDzANBgNVBAsMBkRldk9wczESMBAGA1UEAwwJRUxLIHN0YWNrMIIB
-IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4GgKfmxopGyZePTTd+ShO2gQ
-RmviK+26lqiT7tU7VEWbRIGrDQiWPKDDsKSudMU/+j393ivrZaDxKLS5bH0LSVx7
-Zw0U3wMhKm+PQl2Z+BN5hj7WYwy41EFv5I7/cYMeZO/BLm1nREbDrRKtv+YzBlvg
-o59lEmN74CvVhmiLwxUAWpq+F2em8stgIncdC6KPAaALOe5IMrOv6SnCjxSd5PYh
-XjDWYITVItoxgOc1diUMOfe18+ZeGRxcbqvw9y0w2XJqXZwou7+DFwe3xObJeepH
-6TI9o7Axbk1jIjsNGhRoAfJySIclankpkSj15mcCTnj6yiu858BGWTjBfo5ZzwID
-AQABo1AwTjAdBgNVHQ4EFgQUuprVYwd7ho3iLBYfnvEZQL7ZZ8owHwYDVR0jBBgw
-FoAUuprVYwd7ho3iLBYfnvEZQL7ZZ8owDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0B
-AQsFAAOCAQEAsG2DaqNDKwOUOmbXFxVyiDUbEhonMI+Ex23pksajRsLuRAAZbH65
-EGC/QoWdTNAJEEK7UyTf1Y4TCGSFy+6uL4LEcDDKeMdIhBHpGW3ahrupqo/44v8E
-NmbNg/ZIdQpYb2Ypuer7OD5Fhb9iQqsknG4Iq4yt/sGxKHGf6KPcw5vBq+pVLUbw
-Rs73T8H5NW+7nQCYKTRUOvtf4JH0mq21oXwEo+bFPy+5XOB+jTLmVsxYhgSTzgxu
-8jMJb6xsK2OUGiqIwkFlDGjVin7teobQyJsBIZhJmIudOAHuOcCEkGw6IBnhjhRg
-hH6v84WIHCkYyVeogQXi0ZtmlKx5Y8H8uA==
------END CERTIFICATE-----
diff --git a/test/integration/agent/lumberjack.key b/test/integration/agent/lumberjack.key
deleted file mode 100644
index de0b608..0000000
--- a/test/integration/agent/lumberjack.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDgaAp+bGikbJl4
-9NN35KE7aBBGa+Ir7bqWqJPu1TtURZtEgasNCJY8oMOwpK50xT/6Pf3eK+tloPEo
-tLlsfQtJXHtnDRTfAyEqb49CXZn4E3mGPtZjDLjUQW/kjv9xgx5k78EubWdERsOt
-Eq2/5jMGW+Cjn2USY3vgK9WGaIvDFQBamr4XZ6byy2Aidx0Loo8BoAs57kgys6/p
-KcKPFJ3k9iFeMNZghNUi2jGA5zV2JQw597Xz5l4ZHFxuq/D3LTDZcmpdnCi7v4MX
-B7fE5sl56kfpMj2jsDFuTWMiOw0aFGgB8nJIhyVqeSmRKPXmZwJOePrKK7znwEZZ
-OMF+jlnPAgMBAAECggEAIOYf47jw/moNdfYuqn0SRitTd3+JgPcxS7UbOwB32jr6
-MGjyMs73d5v6FIOQL/5bCszb0x6NPDEEKfuU05rhdLfiP5FjZe6Hhjkkv44JbJ0u
-S8galhrfXf7Z8KAmQvX+Fr4vjCbt5MybE1yRrHiLMnt1y4cqwi9jkdHbVAEvvEGp
-pds6nV4thl/8rcoy3sGWdGF1ixS5ZxSemXNofgszYlfQeVD7Pjk0O1OUyRXsEjLa
-3felRRxnvDfwB9TFZ6rEc/KAS6pA+6NmRWyLe8HLIGjisK0+lU0WkwSGZRm2h8YZ
-kAaV4aqoru0x0OAiN4XTT1RZfJvbPEXpy0+VklkKgQKBgQD2PDc+GsHwM5zOf53r
-adUGeWOXBYNjniKXBd6bjXqYgG0hAZXpU7yHXEVqCIzbA9FvwMKpb9p34a97Z2i5
-+rdE57g5ZOVak0PsdgD9CQoXNWueNxDRE5N9vhcLKh7Pe5pKaMA+Yk7UagSxOWGY
-K2hAxtke7eQirBSDGn//dCSquQKBgQDpTjgA7iGxgn+zKSqaDYp2rmSwaCdqjcxq
-k/I29EmfkdojgJb3uplYGYDz5TQPoC8G0PXeWPHD4b7Uq+drF1BL5ggX3jcATk7G
-WpwgnT1/sOJWT3DzbDRCSWN+uF+23XKem4lwbcXKCC9jSrltue2gx5SKMkCSjlhB
-065KMhjExwKBgQDNBcZZh54DinX92nR7F1uwUFKD5KtJvtm+NbzseBij8grreI6C
-AJ7xdfq2FvhxQ/SWwEFVIzUcrGWYsrmYYRFH5kiWQVRW3leoA3k/Ns+YE3rP+bme
-3FXqVOSK/z84Mwp8+ktXpjNM2hmeFtEUCtB7XxZZkmpqFC3gG6iH4wTEwQKBgGT4
-OB6W8LgNHU0hdNGFKLaiVOtPuDdSNPSvILWN1cscaUbSIQQHmtPY/ckQGg7lKVUO
-3EmlPsSij18lIptjVJn0bO4/ephES61mi4lF49a+a8YkzWJcIuXJMykljC7s+e0Q
-rVOd/mqoTjHvpf6J6ACcP3nrs6x5tFKQ1S5BLh0DAoGBAOaqhwXyf/BCMN0XiWm/
-JlfQ3FEy8IEQ6jVOivw4YD6UdgaOYmDtkZjF0R3FkaPFbjjXaDv97BrimuLrbyfi
-4kcps02DI+aGtTDNnrTl6NNk7IcCRsl8Q6jqWfTBk3zLu36UzV7WPblu0mRcWdxC
-I7nv8uPi2Uvf2Ce57MrSV/YP
------END PRIVATE KEY-----
diff --git a/test/integration/agent/serverspec/default_spec.rb b/test/integration/agent/serverspec/default_spec.rb
index b87c46e..c976af1 100644
--- a/test/integration/agent/serverspec/default_spec.rb
+++ b/test/integration/agent/serverspec/default_spec.rb
@@ -34,16 +34,6 @@
   describe command('/opt/logstash/agent/bin/logstash agent -f /opt/logstash/agent/etc/conf.d/ -t 2>&1 | grep -s "Configuration OK"') do
     its(:exit_status) { should eq 0 }
   end
-
-  describe 'lumberjack keypair' do
-    describe file('/opt/logstash/lumberjack.crt') do
-      it { should be_file }
-    end
-
-    describe file('/opt/logstash/lumberjack.key') do
-      it { should be_file }
-    end
-  end
 end
 
 describe 'on supplying a custom logstash configuration file' do
diff --git a/test/integration/default/data_bags/lumberjack/secrets.json b/test/integration/default/data_bags/lumberjack/secrets.json
deleted file mode 100644
index d5965f4..0000000
--- a/test/integration/default/data_bags/lumberjack/secrets.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "id": "secrets",
-  "key": {
-    "encrypted_data": "qxuJ+RzPMC0a4UlXT4fbik7urRHVsTG3BSC5+0BsI+U4u03yOBv7yJF1Se1G\nl/D/rHHEzEf5ZigdRmHr/ytjGqBEB2jLzoKk3OYXR2DRumJCF8cNJ+rQDgNg\nNOpQY4Q5BKzVO1rBWVfqfYXNcgoz+jC2Ix83oWIgWhif+Yi9n5jf0egapb3z\nxYaHaGS1+Dg7aEuU14R1/fET4rvwVQYPjjoDrl0wiNMQemaop3uAG6HQGw0S\nYqTHxPHcBF5EerQLeV6PJluHzohK3gYLqyqxdMoD4fdbY2Atsi7IeYogguO2\nm8bQQyoBQ746q3X2PgrP8TcVV1KOthCt5GtTK1E7V1tkVyijGJz+QqiK9IVs\nSwDAmzImqCQNEddQrpf2vBxSQu7f87WF2bHj4rpO6F4JM6vkAlRyU0Q+rgEX\nBgFQw6fBJPd58l8ro7RITaJKw5WzTJBTbQPGLHUYG8p/lIw2FoLOvL2Y71kr\nRbUoWE6y7SI3/zL8UVxPR+xlXCcSYN40d0MwgaAJ13K8oqK3i6EsDvqIE43i\n0CVG53s2L8vkW7FzItxasTEv7Gvp5TyUmShaqObibxBEh/qlqQ8Oq4ntGWH3\nOWWBkC5tjN4DRTBZ4IWshUnwzHA3gvnKmjNNYP8LLB+SmHmWt6yJBUGteREz\nsu+RLsQB4Zo9X1mR4VYMieqQA9L0+NK7wIFvTPJVjb8mVSuZ+7vz9u0PXAwh\nW4jGWXpJjqNHyW/QwjagreUUDmPQdW4XpoG/eUecLs5kWIPbTkdD0ofsk+KX\nRIU71YvdtvoHXLc8XPryKJw2N3eNsLHBqC+OXzoXblequkG6hCroOXIZSKOt\nEBHQm3A3JYXzNXPEBUPekojdOg7LolLXWlb4ZGd/Jvsvb8V0j6KiJO0oUsWk\nByQyHDZRL0A8DTKVOPvVjT5v4Hv0sRtCustfZMsYS9dPIcrPQygOCCHKEO1L\nAd5ja84zNPpBSNK+AFEs6Ef/sXYzYGMSqWgQlPkJX+aqncEI0QA6V6E+rjk1\nvG5UGmAeor/GaIUx1W3VZxdxJk+W5jAxEh7C2XX2x7MwA0NBeweaNxFvRPQ2\nGSbIyccydpW8SLSvrapGQv9bLqYcNNN41WdSxEAec47MZa1src/K9qw8SMlY\nAoyUpViuwv1YcL91VomlQEjK++9svrYDahUm6K3wHSiKDa+Ddl+b1OZUhk2m\nm0FJR8f+sTbBiT3IBAS2Ppm6v+ZOfaAXR0ImwiEtN20woe1ABPeH644wyZ4W\n+yS9t9HTTCU8L3/+2rnRXFvYmhqN/57NkyXkBnghCIfbHyFgS/sC9bqvbP5b\n/p5ch0I/CNQJJNvzemwSWlDr/ssUjnNAbarC1XTfamsNlpX0EIn5JXfaqFKS\nfpmDXUB+4ASh9a6yuviqn6HrDgv9H4b9G2qvyM3zXg+0lfy8+9Pj7qSJOLfb\nZX3GI8E72hAdkROCYx+Vwt4AqxfGhYZm6Fi93GArn8g6Qal4g7VyrH0ZoHQ2\nEIevrwvrw28vheGqme7syHKUzZsQEXLSXXHFzXSuJ9yaaPV2TpmF310BdHcx\nRjfWP9KxZooSLOy1h+//mUeypPxYsK2e7bD8PAgwT3Qi58hUSlWfrdUzIvzh\n+lsiwiMqU5kA02qsD02rdC3/JhqJP+S+NXJ7dGSaqfBx9x+CNDr6OniE5Mf7\nrUtuKKu/4Qfe3steSLJSpuwI7rkwTrTFj37Jaf1SybqNOR5UUKiAAMZwmPU2\nTlW7dx6Ao/2g+hPgh0ScNZUeRuXG4Ipjp+a6pg4hYhcvhorjPR7cDBugyjln\nrsVTZi7cCiZgxtZEJ8FLGTUDDFCFQ5A43MaKRsSNCg1rKNIQamqIEkYWLDii\nzYX8L4bBPPmqG9aGzwNWpqHxlCgwE5+hBE4m58fBu8A+MY1daBgOaWUxUM9S\ntB1h2aBkWR1VNlWq9FvzmaC42ZrdMH4/psZ26mLekdEfbc6usQIYSFteDWvw\nFDmglmKCXQgcv48hQAQECy541QFX1JYZ7gkrkKCLmUXPLOoSqBRBkgCG2f9h\nd1YgZE9H++dwruUzsqmN6kS7QpfBZf+rAymf44VO4gFTPN42ICZ97rh42Npe\n/Bbv3neC+snJh/65snEznNO1Dp0Lqdb16lPNgKotz9gNPFJ5yVoMnXSBtS6+\nKKTnzpQwRprZdQMyVKvAMMWetlWTo6xQNFrSPmqXgZ9zg4pA6qNtetNEnt1z\nLuzzFZ8XXWpHdGqZGD6SEydp49nBanmppa6f4wM3wrPMH6SnFAjGNQ/U//7H\nqeuPBfyygNjxx+LHK2PnewXYbq0em6p0IaCsy4YIUCB1q5NWf8WyUMC0btLi\nAeHYDKiJ7319S0/1/wIxXVqYX5eKbacePT+YtQ579WjdvT+Z9LiZi3FBcnCC\nZyXiCuWxqHx0MGONLBQDJHq35ASQCIvZC+gSxY8g2BYn4EnNoPIjTlk7qaVr\nPZvLEGQIYxNlLD0ZTqf5URko83Dlw8jO3j0Ho/BJUB69+obpj5fbcw5UtaJi\nQpaSQhqn6THedlUJT1cLEURhi9psk+V49pO4nYTpIBiuAtx9P2KuuaAa24te\nWUUKODG9ft3olhxHqs2K6tAgCXUvi67guADcBFJBDOeXdwNUidv4LoBmeIhU\noNLWBxZhDavVn9K9TgAPbPBbL1tPN6s5RnM8sgHR7orOLK8rbZYOHnwKa+5d\nfvXAzEc217xcnkLa2+k64jy2LWO6tmk4Kyg8oxHi7uunB5mfh9r2vJTpwGeQ\n/M7Yof8oxnCNps53SJlMtAlOf/tmFWaIxacCBAtf1RgB5e0KcRvqkqyeqomX\nXYz8hcGh7PuljmykmI+pWIDykNSFdMtr9fpIzrFhdGepPUHmKJiTbHRUwg5w\n8e9BSUNqJhlYMavmCV/sF17LWI43O/mEGHTOPQLZzcFEDWdz06ZhsFNIC0MY\nOHud4BdV5af/HWjG4cfd08tK4wLWunftRbGGQf0OKRjmGpHpSUYAygaSNGwd\n0Ra1hzLxTsWesDPSMe8MmrOy82mtkOoukoU6hUq8eG4iI3fTHVn79oZ+8Yp9\n/inwUYMHVfOF\n",
-    "iv": "mXhr+Pz2NYk0jtE/9hgG2A==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
-  },
-  "certificate": {
-    "encrypted_data": "85kp1lnnQgGqLsLVh9c7Fvx1JtXz0uYif3Xw6EvJScZPqVrOKsyLKFHkw/1V\nDND53FkNJeooQOSmDv7KcFS3e4mo2bGM8KDc1aU0hdndrH2xygIzzkDGys35\nv7O7GHJCRxYZJRJZ0TMwkz+1RUNRKBzTdWH5i1y0Jvw47UH9Xp6k+gP6G6SX\nC0VBXG0G40QZA1X6odghOa50KW16PRrNu9x7Av4puYZGO63gQtwOc1HnZp2L\nPAmgErpVdmdIOj6yW/vQdnzWQnSle2sjSJhFLRc6jWSSep5UvZ0wSR+0RZBE\nPBiW2zCwCR8SMapB88ZMd3LUMfz4TtDx5SI7df/EwLx1G0PnMZIuc+tGT8b8\n43kqytf4gd4DpgIF+SykMOwg27eJZhnGh9r9UDsv4pQeCcLRh9oBC0SqMtq9\nRzf1ChYpjxHy1feeFaSYtAV4t3TewvDCxjnty5o5YwOc3F035eWzPVQGhL6c\n4nkYv/HKTOQ86d9cARpaGB424E5XQZj1uFEZLcpmzdtn9IySlG/QSxegbkC7\n4u3RZcc+0WkEFM6CGcx5UC1xXsuWJaT+m4CduM6bs7M5+TrJthybUFWp6GHJ\nKwalwLp4VKmatHvxArx0FJ5W0vcfxJW7x7Me5/xp/Q7cb1jT0eUa8p5u4bTG\ngh7q485RI+k0Du4zovtC2/CznvOCsvwo95bvHLp9a5EpcXvZsvhzTbL2+sSE\nnBKilJ62ZegDwBKSodFOtKrgKwAOhGCSj76f1aFZ0SXUVv1lqlXiSUT0VkMK\na4HdbdXoWpobvspRS/To7JATPpGvgkItpK0SEH5y73xO6A4Fk0eCxH6yiCTH\njdQBeasa+zsx4FRjYCxjT4v6rMw6A+RgpEBN5o7V1vtJOtS6wHMRi8VNX8tm\n4XKP5xXsY4S2UJNKXhCVLtt0rM5M77544lonjJ2pAdy0Ptw6W8tXAS1Uwl6l\nNB2s5ygLL280afmBGUCJ9dcpJiyxslgCU8Z1Kbz7eYX4JcYOLl6FRjc62QxE\neFDuKX6lp6dxNeXE4ADJVzFHxpFlFpw8bMcKn6Lez1RVPk+l8LM8FMmDIxKY\nw0FfGnOfpkjXC7ly8lRnNSwvuZsSnawaHBI0hwutgGlpjIVLw+cc+cKk+vnl\n6I5IwBejjKdlzAsQVDjGMDHmcmUJ45tzDd5PIJBtWQdHKAPN7HgGfLy2BmDZ\nNpsNB5FLTcjPYP7dQ2qKLdmKKeFTBygM63UXT3Dw0IPKRkMGVeyWuIbzceqe\nJvcnYVRbDb+2j412LTLSIJqhmp3mAllNKV2t84atUZGtUlFd45I0wR6/JHJS\nS5BZVNBDW+fiVixFNpwoY2TjS0UZWQ0PCxeCxxIDL4IaqUrS9Z51qyyq4kaT\nCXJuCl8QSKW4Yb0Q+OTr/3mIGz8arzTB6TbgNj/AerbN6ntpYHKD0leeK5p7\n35D4uKR6UelYNagAWH3wNZ+4G22BA9izShIWkAZgAUli6xT6hR8SuFlYTHCK\nKfTeRW8r1eUwwFXdypbe76sFNq/1FIj+n0OO0MqV65vOSlQrOVZlURkHDkMz\nRxx6IHmmAqA4Hy+zjbC4Qj6vsjDrQnk0CT89stRoU5f7KTWK80xxdVVFquNN\nwGz3svQVSk6tbAzGLhxSStTZVfjeM2/mGc1ZyDvUzSnoAKki7YNQlYAQbMLa\nUZVR9raMOoxtJSC23RXt8bxESNE3ZjmqUlF7OR/KQ40ctV2pUxW4emyKF9yj\ntld2UtIcgW64QWbjiQQ5YHjDwE9T4mwEP39vVfoLAJNKnThuUI0xPTdUWrhl\nl3fPDi2AAUIu+fUOKq6E5eehovcV2mP8+TKsILxJMIfzVmhPMOiqO00dF8tM\nKkQ8eX54S4vIYrHVI+t/PWHCjO425Xw1r4rWAulNkvCRQWAdltYM5REzVE7p\nUy1oOJotJu+ZIXf+zRdWZD45j5ldTV4ldPsU8Zx9QqrDyUT3aoDNJ2Ufut8c\nvJ+5Edy0Enc8D1rE3pFnzgliwMwqQ2tGizJgQqGirsMAO88bNCgqQqrG5VDo\nSGW+LG/SEyAmqM1+kQQuTNgAlTfH7kC7wy/YESqMXSOy5s4qGr1DWdJwjs8z\noKreJlxdgxp4c5mk7gGVkW45bi+qyjLgqQMIbuKr8///nbOvHm137M9W6Eie\nv7f99bqvmoEdIvf6kspTx7hqfIAWl5ucC7qJh+ePEoIzYi8hT0xdP5y/g555\n6bIq8ZKMzEFxqaSnIVs4+r0s79br7p1OvVlGJcgPOkHHsxHOS5jBRkVPWMRO\nRlXUBwKCLVwbuSDbeCGpocBkZtBP8pWqrq9acPSOvtVL/YtzlYt2zmgi+8q3\nbMaXjrq+wy2AG0+ltobIyouqzGQSoGFEH1rc1MGgKZp7vE8ZNw==\n",
-    "iv": "dbb9vo/Vy9w+wnZEeKs2Rg==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
-  }
-}
\ No newline at end of file
diff --git a/test/integration/default/serverspec/logstash.rb b/test/integration/default/serverspec/logstash.rb
index bc9eebc..877b91c 100644
--- a/test/integration/default/serverspec/logstash.rb
+++ b/test/integration/default/serverspec/logstash.rb
@@ -21,13 +21,3 @@
 describe command('/opt/logstash/server/bin/logstash agent -f /opt/logstash/server/etc/conf.d/ -t 2>&1 | grep -s "Configuration OK"') do
   its(:exit_status) { should eq 0 }
 end
-
-describe 'lumberjack keypair' do
-  describe file('/opt/logstash/lumberjack.crt') do
-    it { should be_file }
-  end
-
-  describe file('/opt/logstash/lumberjack.key') do
-    it { should be_file }
-  end
-end
diff --git a/test/integration/forwarder/serverspec/default_spec.rb b/test/integration/forwarder/serverspec/default_spec.rb
index 532894a..67a466e 100644
--- a/test/integration/forwarder/serverspec/default_spec.rb
+++ b/test/integration/forwarder/serverspec/default_spec.rb
@@ -9,7 +9,7 @@
 describe 'logstash-forwarder service' do
   # can't use process() matcher because of two java processes
   describe 'should be running Logstash main class' do
-    describe command('ps aux | grep -v grep | grep -s /opt/logstash-forwarder/logstash-forwarder') do
+    describe command('ps aux | grep -v grep | grep -s /opt/logstash-forwarder/bin/logstash-forwarder') do
       its(:exit_status) { should eq 0 }
     end
   end
diff --git a/test/integration/nodes/elasticsearch-01.json b/test/integration/nodes/elasticsearch-01.json
index 4f22716..a33afcb 100644
--- a/test/integration/nodes/elasticsearch-01.json
+++ b/test/integration/nodes/elasticsearch-01.json
@@ -13,7 +13,7 @@
       "elasticsearch"
     ],
     "tags": [
-      "elkstack_cluster"
+      "elkstack"
     ]
   },
   "normal": {
diff --git a/test/integration/nodes/elasticsearch-02.json b/test/integration/nodes/elasticsearch-02.json
index 91bfa4b..8200ecb 100644
--- a/test/integration/nodes/elasticsearch-02.json
+++ b/test/integration/nodes/elasticsearch-02.json
@@ -13,7 +13,7 @@
       "elasticsearch"
     ],
     "tags": [
-      "elkstack_cluster"
+      "elkstack"
     ]
   },
   "normal": {
diff --git a/test/unit/spec/agent_nokeypair.rb b/test/unit/spec/agent_nokeypair.rb
index 1043600..e08937c 100644
--- a/test/unit/spec/agent_nokeypair.rb
+++ b/test/unit/spec/agent_nokeypair.rb
@@ -15,7 +15,6 @@
       node.set['rackspace']['cloud_credentials']['api_key'] = '123abc'
       node.set['filesystem'] = []
 
-      node.set['elkstack']['config']['cluster'] = false
       node.set['elkstack']['config']['iptables'] = false
       node.set['elasticsearch']['discovery']['zen']['ping']['unicast']['hosts'] = '127.0.0.1'
     end.converge(described_recipe)
diff --git a/test/unit/spec/agent_spec.rb b/test/unit/spec/agent_spec.rb
index 759fc2d..ae9e7b3 100644
--- a/test/unit/spec/agent_spec.rb
+++ b/test/unit/spec/agent_spec.rb
@@ -19,7 +19,7 @@
     expect(chef_run).to include_recipe('elkstack::agent')
     # Not with chef-solo.
     # expect(chef_run).to include_recipe('elasticsearch::search_discovery')
-    expect(chef_run).to include_recipe('elkstack::_secrets')
+    expect(chef_run).to include_recipe('elkstack::_lumberjack_secrets')
     expect(chef_run).to include_recipe('rsyslog::client')
   end
 
@@ -55,7 +55,7 @@
     expect(chef_run).to include_recipe('elkstack::agent')
     # Not with chef-solo.
     # expect(chef_run).to include_recipe('elasticsearch::search_discovery')
-    expect(chef_run).to_not include_recipe('elkstack::_secrets')
+    expect(chef_run).to_not include_recipe('elkstack::_lumberjack_secrets')
     expect(chef_run).to_not include_recipe('rsyslog::client')
   end
 end
@@ -77,7 +77,7 @@
     expect(chef_run).to include_recipe('elkstack::agent')
     # Not with chef-solo.
     # expect(chef_run).to include_recipe('elasticsearch::search_discovery')
-    expect(chef_run).to_not include_recipe('elkstack::_secrets')
+    expect(chef_run).to_not include_recipe('elkstack::_lumberjack_secrets')
     expect(chef_run).to_not include_recipe('rsyslog::client')
   end
 end
@@ -98,7 +98,7 @@
     expect(chef_run).to include_recipe('elkstack::agent')
     # Not with chef-solo.
     # expect(chef_run).to include_recipe('elasticsearch::search_discovery')
-    expect(chef_run).to_not include_recipe('elkstack::_secrets')
+    expect(chef_run).to_not include_recipe('elkstack::_lumberjack_secrets')
     expect(chef_run).to_not include_recipe('rsyslog::client')
   end
 end
diff --git a/test/unit/spec/default_spec.rb b/test/unit/spec/default_spec.rb
index 26982e3..6ece322 100644
--- a/test/unit/spec/default_spec.rb
+++ b/test/unit/spec/default_spec.rb
@@ -2,7 +2,7 @@
 
 require_relative 'spec_helper'
 
-describe 'elkstack::cluster' do
+describe 'elkstack::default' do
   let(:chef_run) do
     stub_resources
     ChefSpec::SoloRunner.new(platform: 'redhat', version: '6.5') do |node|
diff --git a/test/unit/spec/elasticsearch_nokeypair.rb b/test/unit/spec/elasticsearch_nokeypair.rb
index 9b9a79c..6038cb2 100644
--- a/test/unit/spec/elasticsearch_nokeypair.rb
+++ b/test/unit/spec/elasticsearch_nokeypair.rb
@@ -2,7 +2,7 @@
 
 require_relative 'spec_helper'
 
-describe 'elkstack::cluster' do
+describe 'elkstack::default' do
   let(:chef_run) do
     ChefSpec::SoloRunner.new(platform: 'redhat', version: '6.5') do |node|
       stub_resources
@@ -15,7 +15,6 @@
       node.set['rackspace']['cloud_credentials']['api_key'] = '123abc'
       node.set['filesystem'] = []
 
-      node.set['elkstack']['config']['cluster'] = false
       node.set['elkstack']['config']['iptables'] = false
     end.converge(described_recipe)
   end
diff --git a/test/unit/spec/forwarder_spec.rb b/test/unit/spec/forwarder_spec.rb
index 122053a..1694db2 100644
--- a/test/unit/spec/forwarder_spec.rb
+++ b/test/unit/spec/forwarder_spec.rb
@@ -13,11 +13,10 @@
     end.converge(described_recipe)
   end
 
-  it 'includes the _agent, elasticsearch::search_discovery, _secrets, golang, and rsyslog::client recipes' do
-    expect(chef_run).to include_recipe('golang')
+  it 'includes the _agent, elasticsearch::search_discovery, _secrets, and rsyslog::client recipes' do
     expect(chef_run).to include_recipe('elkstack::forwarder')
     expect(chef_run).to include_recipe('elasticsearch::search_discovery')
-    expect(chef_run).to include_recipe('elkstack::_secrets')
+    expect(chef_run).to include_recipe('elkstack::_lumberjack_secrets')
   end
 
   it 'create service for the forwarder' do
@@ -30,8 +29,8 @@
     expect(chef_run).to create_file('/opt/logstash/lumberjack.crt')
   end
 
-  it 'compiles logstash-forwarder' do
-    expect(chef_run).to run_execute('/usr/local/go/bin/go build')
+  it 'installs logstash-forwarder pkg' do
+    expect(chef_run).to install_package('logstash-forwarder')
   end
 
   it 'creates logstash-forwarder configuration file' do
diff --git a/test/unit/spec/spec_helper.rb b/test/unit/spec/spec_helper.rb
index bed6336..6524095 100644
--- a/test/unit/spec/spec_helper.rb
+++ b/test/unit/spec/spec_helper.rb
@@ -13,7 +13,7 @@ def stub_resources
   allow(Chef::Search::Query).to receive(:new).and_return(chef_search_query)
 
   # elkstack search
-  elk_query_str = 'tags:elkstack_cluster AND chef_environment:_default AND elasticsearch_cluster_name:elasticsearch AND NOT name:fauxhai.local'
+  elk_query_str = 'tags:elkstack AND chef_environment:_default AND elasticsearch_cluster_name:elasticsearch AND NOT name:fauxhai.local'
   allow(chef_search_query).to receive(:search).with(:node, elk_query_str).and_return({}) # stub this search
 
   # logstash search