These configs are part of the "adding Logstash to filebeat modules getting started experience" and therefore its very likely the first time a user will see a LS config.

For the best experience we should add a fair few comments to better inform what is going on. The user sees the nested field reference for the first time and there is a try three grok pattern scheme with two mutate renames that w

It seems that the current behavior when rvm automatically switches Ruby versions is to do it silently if it's by .ruby-version or, if it's because of a Gemfile, display that three-line warning about how Heroku does it too and with instructions on how not to show that warning again.

I think .ruby-version switching the Ruby version silently is not great, because it requires that the user remember