packetbeat = {
    enable = true;
    package = pkgs.packetbeat7;
    settings = {
      name = config.networking.hostName;
      packetbeat = {
        interfaces = {
          device = "ens3";
          type = "af_packet";
          ignore_outgoing = true;
        };
        protocols = {
          tls = {
            ports = [ 443 993 995 5223 8443 8883 9243 ];
            send_certificates = true;
            include_raw_certificates = false;
            include_detailed_fields = true;
            fingerprints = [ "md5" "sha1" "sha256" ];
          };
        };
      };
      output = {
        elasticsearch = lib.mkForce {};
        file = {
          path = "/var/log/packetbeat";
          filename = "packetbeat.log";
          rotate_every_kb = "102400";
          number_of_files = "20";
        };
      };
      fields = {
        env = "utility";
      };
      processors = [ "add_host_metadata: ~" ];
    };
  };