diff --git a/deployment/logging/rsyslog-container-puppet.yaml b/deployment/logging/rsyslog-container-puppet.yaml
index a6a3c85a63..6be8f8266c 100644
--- a/deployment/logging/rsyslog-container-puppet.yaml
+++ b/deployment/logging/rsyslog-container-puppet.yaml
@@ -53,6 +53,14 @@ parameters:
     default: ''
     description: Contains content of the private key corresponding to the cert RsyslogElasticsearchTlsClientCert.
     type: string
+  CloudName:
+    default: overcloud.localdomain
+    description: The DNS name of this cloud. E.g. ci-overcloud.tripleo.org
+    type: string
+  KeystoneRegion:
+    type: string
+    default: 'regionOne'
+    description: Keystone region for endpoint
 
 resources:
   ContainersCommon:
@@ -136,6 +144,7 @@ outputs:
                 - property:
                     outname: '@timestamp'
                     name: timereported
+                    dateFormat: 'rfc3339'
                     format: jsonf
                 - property:
                     outname: host
@@ -143,7 +152,7 @@ outputs:
                     format: jsonf
                 - property:
                     outname: severity
-                    name: syslogseverity-text
+                    name: syslogseverity
                     format: jsonf
                 - property:
                     outname: facility
@@ -161,6 +170,19 @@ outputs:
                     outname: message
                     name: msg
                     format: jsonf
+                - property:
+                    outname: file
+                    name: '$!metadata!filename'
+                    format: jsonf
+                - constant:
+                    outname: cloud
+                    value: {get_param: CloudName}
+                    format: jsonf
+                - constant:
+                    outname: region
+                    value: {get_param: KeystoneRegion}
+                    format: jsonf
+
             tripleo::profile::base::logging::rsyslog::elasticsearch:
               map_merge:
                 - {get_param: RsyslogElasticsearchSetting}