diff --git a/data/common/common.yaml b/data/common/common.yaml
--- a/data/common/common.yaml
+++ b/data/common/common.yaml
@@ -3248,7 +3248,7 @@
     port: "%{hiera('swh::deploy::db::pgbouncer::port')}"
     user: guest
 
-elastic::elk_version: '7.8.0'
+elastic::elk_version: '7.15.1'
 
 elasticsearch::hosts:
     - http://esnode1.internal.softwareheritage.org:9200
diff --git a/data/deployments/staging/common.yaml b/data/deployments/staging/common.yaml
--- a/data/deployments/staging/common.yaml
+++ b/data/deployments/staging/common.yaml
@@ -289,8 +289,6 @@
 
 # Elasticsearch
 
-elastic::elk_version: '7.9.3'
-
 elasticsearch::config::cluster::name: swh-search
 
 elasticsearch::config::discovery::seed_hosts:
diff --git a/data/hostname/esnode1.internal.softwareheritage.org.yaml b/data/hostname/esnode1.internal.softwareheritage.org.yaml
--- a/data/hostname/esnode1.internal.softwareheritage.org.yaml
+++ b/data/hostname/esnode1.internal.softwareheritage.org.yaml
@@ -11,6 +11,5 @@
     - zfsutils-linux
     - zfs-zed
 
-elastic::elk_version: '7.15.1'
 elasticsearch::config::extras:
   xpack.security.enabled: false
diff --git a/data/hostname/esnode2.internal.softwareheritage.org.yaml b/data/hostname/esnode2.internal.softwareheritage.org.yaml
--- a/data/hostname/esnode2.internal.softwareheritage.org.yaml
+++ b/data/hostname/esnode2.internal.softwareheritage.org.yaml
@@ -11,6 +11,5 @@
     - zfsutils-linux
     - zfs-zed
 
-elastic::elk_version: '7.15.1'
 elasticsearch::config::extras:
   xpack.security.enabled: false
diff --git a/data/hostname/esnode3.internal.softwareheritage.org.yaml b/data/hostname/esnode3.internal.softwareheritage.org.yaml
--- a/data/hostname/esnode3.internal.softwareheritage.org.yaml
+++ b/data/hostname/esnode3.internal.softwareheritage.org.yaml
@@ -11,6 +11,5 @@
     - zfsutils-linux
     - zfs-zed
 
-elastic::elk_version: '7.15.1'
 elasticsearch::config::extras:
   xpack.security.enabled: false
diff --git a/data/hostname/kibana0.internal.softwareheritage.org.yaml b/data/hostname/kibana0.internal.softwareheritage.org.yaml
deleted file mode 100644
--- a/data/hostname/kibana0.internal.softwareheritage.org.yaml
+++ /dev/null
@@ -1 +0,0 @@
-elastic::elk_version: '7.15.1'
diff --git a/data/hostname/search-esnode0.internal.staging.swh.network.yaml b/data/hostname/search-esnode0.internal.staging.swh.network.yaml
--- a/data/hostname/search-esnode0.internal.staging.swh.network.yaml
+++ b/data/hostname/search-esnode0.internal.staging.swh.network.yaml
@@ -4,6 +4,9 @@
     netmask: 255.255.255.0
     gateway: 192.168.130.1
 
+elastic::elk_version: '7.9.3'
+elastic::beat_version: '7.15.1'
+
 swh::apt_config::enable_non_free: true
 swh::apt_config::backported_packages:
   buster:
diff --git a/data/hostname/search-esnode4.internal.softwareheritage.org.yaml b/data/hostname/search-esnode4.internal.softwareheritage.org.yaml
--- a/data/hostname/search-esnode4.internal.softwareheritage.org.yaml
+++ b/data/hostname/search-esnode4.internal.softwareheritage.org.yaml
@@ -12,6 +12,7 @@
     - zfs-zed
 
 elastic::elk_version: '7.9.3'
+elastic::beat_version: '7.15.1'
 
 # Elasticsearch
 elasticsearch::config::cluster::name: swh-search
diff --git a/data/hostname/search-esnode5.internal.softwareheritage.org.yaml b/data/hostname/search-esnode5.internal.softwareheritage.org.yaml
--- a/data/hostname/search-esnode5.internal.softwareheritage.org.yaml
+++ b/data/hostname/search-esnode5.internal.softwareheritage.org.yaml
@@ -12,6 +12,7 @@
     - zfs-zed
 
 elastic::elk_version: '7.9.3'
+elastic::beat_version: '7.15.1'
 
 # Elasticsearch
 elasticsearch::config::cluster::name: swh-search
diff --git a/data/hostname/search-esnode6.internal.softwareheritage.org.yaml b/data/hostname/search-esnode6.internal.softwareheritage.org.yaml
--- a/data/hostname/search-esnode6.internal.softwareheritage.org.yaml
+++ b/data/hostname/search-esnode6.internal.softwareheritage.org.yaml
@@ -12,6 +12,7 @@
     - zfs-zed
 
 elastic::elk_version: '7.9.3'
+elastic::beat_version: '7.15.1'
 
 # Elasticsearch
 elasticsearch::config::cluster::name: swh-search
diff --git a/site-modules/profile/manifests/filebeat.pp b/site-modules/profile/manifests/filebeat.pp
--- a/site-modules/profile/manifests/filebeat.pp
+++ b/site-modules/profile/manifests/filebeat.pp
@@ -7,7 +7,8 @@
 
   include ::profile::elastic::apt_config
 
-  $version = lookup('elastic::elk_version')
+  $default_elk_version = lookup('elastic::elk_version')
+  $version = lookup('elastic::beat_version', { default_value => $default_elk_version })
 
   package { 'filebeat':
     ensure => $version,
diff --git a/site-modules/profile/manifests/systemd_journal/journalbeat.pp b/site-modules/profile/manifests/systemd_journal/journalbeat.pp
--- a/site-modules/profile/manifests/systemd_journal/journalbeat.pp
+++ b/site-modules/profile/manifests/systemd_journal/journalbeat.pp
@@ -7,11 +7,25 @@
   $configdir = '/etc/journalbeat'
   $configfile = "${configdir}/journalbeat.yml"
   $service = 'journalbeat'
+  $default_elk_version = lookup('elastic::elk_version')
+  $version = lookup('elastic::beat_version', { default_value => $default_elk_version })
 
   $logstash_hosts = lookup('systemd_journal::logstash_hosts')
 
-  package {$package:
-    ensure => present
+  include ::profile::elastic::apt_config
+
+  # cleanup
+  ::apt::pin {'swh-journalbeat':
+    ensure => absent,
+  }
+  -> ::apt::pin {'journalbeat':
+    explanation => 'Use the elk stack version',
+    packages    => ['journalbeat'],
+    version     => $version,
+    priority    => 1001,
+  }
+  -> package {$package:
+    ensure => $version,
   }
 
   user {$user:
@@ -23,29 +37,32 @@
     system     => true,
   }
 
+  # cleanup pre 7.15 version
+  file {"/etc/systemd/system/${service}.service":
+    ensure  => absent,
+  }
   # Uses variables
   #  - $user
   #  - $homedir
-  #  - $configfile
-  #
-  ::systemd::unit_file {"${service}.service":
+  ::systemd::dropin_file { "${service}.conf":
     ensure  => present,
-    content => template('profile/systemd_journal/journalbeat/journalbeat.service.erb'),
+    unit    => "${service}.service",
+    content => template('profile/systemd_journal/journalbeat/journalbeat.conf.erb'),
   }
   ~> service {$service:
-    ensure  => running,
-    enable  => true,
-    require => [
+    ensure    => running,
+    enable    => true,
+    require   => [
       Package[$package],
+      User[$user],
       File[$configfile],
+      ::Systemd::Dropin_file["${service}.conf"],
+    ],
+    subscribe => [
+      Package[$package],
+      File[$configfile],
+      ::Systemd::Dropin_file["${service}.conf"],
     ],
-  }
-
-  file {$configdir:
-    ensure => directory,
-    owner  => 'root',
-    group  => 'root',
-    mode   => '0644',
   }
 
   # Uses variables
@@ -57,16 +74,8 @@
     group   => 'root',
     mode    => '0644',
     content => template('profile/systemd_journal/journalbeat/journalbeat.yml.erb'),
-    notify  => [
-      Service[$service],
-    ],
-  }
-
-  ::apt::pin {'swh-journalbeat':
-    explanation => 'Use journalbeat packages from Software Heritage',
-    packages    => ['journalbeat'],
-    originator  => 'softwareheritage',
-    priority    => 990,
+    require => [Package[$package]],
+    notify  => [Service[$service]],
   }
 
   profile::cron::d {'logrotate-journal':
diff --git a/site-modules/profile/templates/logstash/filter.conf.erb b/site-modules/profile/templates/logstash/filter.conf.erb
--- a/site-modules/profile/templates/logstash/filter.conf.erb
+++ b/site-modules/profile/templates/logstash/filter.conf.erb
@@ -17,15 +17,31 @@
       }
     }
   } else if "swh-worker@" in [systemd_unit] {
+    # Temporary rule to delete after complete migration to 7.15.1
     mutate {
       add_field => {
         "[@metadata][target_index]" => "swh_workers-%{+YYYY.MM.dd}"
       }
     }
-  } else {
+  } else if "swh-worker@" in [systemd][unit] {
     mutate {
       add_field => {
-        "[@metadata][target_index]" => "systemlogs-%{+YYYY.MM.dd}"
+        "[@metadata][target_index]" => "swh_workers-%{[@metadata][version]}-%{+YYYY.MM.dd}"
+      }
+    }
+  } else {
+    if [@metadata][version] {
+      mutate {
+        add_field => {
+          "[@metadata][target_index]" => "systemlogs-%{[@metadata][version]}-%{+YYYY.MM.dd}"
+        }
+      }
+    } else {
+      # Temporary rule to delete after complete migration to 7.15.1
+      mutate {
+        add_field => {
+          "[@metadata][target_index]" => "systemlogs-%{+YYYY.MM.dd}"
+        }
       }
     }
   }
diff --git a/site-modules/profile/templates/systemd_journal/journalbeat/journalbeat.service.erb b/site-modules/profile/templates/systemd_journal/journalbeat/journalbeat.conf.erb
rename from site-modules/profile/templates/systemd_journal/journalbeat/journalbeat.service.erb
rename to site-modules/profile/templates/systemd_journal/journalbeat/journalbeat.conf.erb
--- a/site-modules/profile/templates/systemd_journal/journalbeat/journalbeat.service.erb
+++ b/site-modules/profile/templates/systemd_journal/journalbeat/journalbeat.conf.erb
@@ -1,19 +1,8 @@
 # Managed by puppet (class profile::systemd_journal::journalbeat), changes will be lost
 
-[Unit]
-Description=Send systemd journal messages to logstash
-After=nss-lookup.target
-
 [Service]
-Type=simple
-Restart=always
-RestartSec=20s
-ExecStart=/usr/bin/journalbeat -e -c <%= @configfile %>
 User=<%= @user %>
 Group=systemd-journal
 ReadOnlyDirectories=/
 ReadWriteDirectories=-<%= @homedir %>
 WorkingDirectory=<%= @homedir %>
-
-[Install]
-WantedBy=multi-user.target
diff --git a/site-modules/profile/templates/systemd_journal/journalbeat/journalbeat.yml.erb b/site-modules/profile/templates/systemd_journal/journalbeat/journalbeat.yml.erb
--- a/site-modules/profile/templates/systemd_journal/journalbeat/journalbeat.yml.erb
+++ b/site-modules/profile/templates/systemd_journal/journalbeat/journalbeat.yml.erb
@@ -1,6 +1,12 @@
 #======================== Journalbeat Configuration ============================
 
 journalbeat:
+  inputs:
+    # Paths that should be crawled and fetched. Possible values files and directories.
+    # When setting a directory, all journals under it are merged.
+    # When empty starts to read from local journal.
+    - paths: []
+
   # What position in journald to seek to at start up
   # options: cursor, tail, head (defaults to tail)
   seek_position: cursor