diff --git a/README.md b/README.md
index ff7f45e..bd93f0f 100644
--- a/README.md
+++ b/README.md
@@ -10,9 +10,10 @@
 The charts used in this setup are the chart provided in the open source and can be
 found on GitHub:
 
-- [Prometheus](https://github.com/helm/charts/tree/master/stable/prometheus)
 - [Grafana](https://github.com/helm/charts/tree/master/stable/grafana)
 - [Loki](https://github.com/grafana/loki/tree/master/production/helm/loki)
+- [Prometheus](https://github.com/helm/charts/tree/master/stable/prometheus)
+- [Promtail](https://github.com/grafana/loki/tree/master/production/helm/promtail)
 
 This project just provides `values.yaml`-files that are already configured to
 work with the `metrics-reporter-prometheus`-plugin of Gerrit to make the setup
@@ -76,43 +77,43 @@
 These options have to be configured in the `./config.yaml` before installing and
 are listed here:
 
-| option                                  | description                                                                            |
-|-----------------------------------------|----------------------------------------------------------------------------------------|
-| `gerritServers`                         | List of Gerrit servers to scrape. For details refer to section [below](#gerritServers) |
-| `namespace`                             | The namespace the charts are installed to                                              |
-| `tls.skipVerify`                        | Whether to skip TLS certificate verification                                           |
-| `tls.caCert`                            | CA certificate used for TLS certificate verification                                   |
-| `prometheus.server.host`                | Prometheus server ingress hostname                                                     |
-| `prometheus.server.username`            | Username for Prometheus                                                                |
-| `prometheus.server.password`            | Password for Prometheus                                                                |
-| `prometheus.server.tls.cert`            | TLS certificate                                                                        |
-| `prometheus.server.tls.key`             | TLS key                                                                                |
-| `prometheus.alertmanager.slack.apiUrl`  | API URL of the Slack Webhook                                                           |
-| `prometheus.alertmanager.slack.channel` | Channel to which the alerts should be posted                                           |
-| `loki.host`                             | Loki ingress hostname                                                                  |
-| `loki.username`                         | Username for Loki                                                                      |
-| `loki.password`                         | Password for Loki                                                                      |
-| `loki.s3.protocol`                      | Protocol used for communicating with S3                                                |
-| `loki.s3.host`                          | Hostname of the S3 object store                                                        |
-| `loki.s3.accessToken`                   | The EC2 accessToken used for authentication with S3                                    |
-| `loki.s3.secret`                        | The secret associated with the accessToken                                             |
-| `loki.s3.bucket`                        | The name of the S3 bucket                                                              |
-| `loki.s3.region`                        | The region in which the S3 bucket is hosted                                            |
-| `loki.tls.cert`                         | TLS certificate                                                                        |
-| `loki.tls.key`                          | TLS key                                                                                |
-| `grafana.host`                          | Grafana ingress hostname                                                               |
-| `grafana.tls.cert`                      | TLS certificate                                                                        |
-| `grafana.tls.key`                       | TLS key                                                                                |
-| `grafana.admin.username`                | Username for the admin user                                                            |
-| `grafana.admin.password`                | Password for the admin user                                                            |
-| `grafana.ldap.enabled`                  | Whether to enable LDAP                                                                 |
-| `grafana.ldap.host`                     | Hostname of LDAP server                                                                |
-| `grafana.ldap.port`                     | Port of LDAP server (Has to be `quoted`!)                                              |
-| `grafana.ldap.password`                 | Password of LDAP server                                                                |
-| `grafana.ldap.bind_dn`                  | Bind DN (username) of the LDAP server                                                  |
-| `grafana.ldap.accountBases`             | List of base DNs to discover accounts (Has to have the format `"['a', 'b']"`)          |
-| `grafana.ldap.groupBases`               | List of base DNs to discover groups (Has to have the format `"['a', 'b']"`)            |
-| `grafana.dashboards.editable`           | Whether dashboards can be edited manually in the UI                                    |
+| option                                             | description                                                                            |
+|----------------------------------------------------|----------------------------------------------------------------------------------------|
+| `gerritServers`                                    | List of Gerrit servers to scrape. For details refer to section [below](#gerritServers) |
+| `namespace`                                        | The namespace the charts are installed to                                              |
+| `tls.skipVerify`                                   | Whether to skip TLS certificate verification                                           |
+| `tls.caCert`                                       | CA certificate used for TLS certificate verification                                   |
+| `monitoring.prometheus.server.host`                | Prometheus server ingress hostname                                                     |
+| `monitoring.prometheus.server.username`            | Username for Prometheus                                                                |
+| `monitoring.prometheus.server.password`            | Password for Prometheus                                                                |
+| `monitoring.prometheus.server.tls.cert`            | TLS certificate                                                                        |
+| `monitoring.prometheus.server.tls.key`             | TLS key                                                                                |
+| `monitoring.prometheus.alertmanager.slack.apiUrl`  | API URL of the Slack Webhook                                                           |
+| `monitoring.prometheus.alertmanager.slack.channel` | Channel to which the alerts should be posted                                           |
+| `monitoring.grafana.host`                          | Grafana ingress hostname                                                               |
+| `monitoring.grafana.tls.cert`                      | TLS certificate                                                                        |
+| `monitoring.grafana.tls.key`                       | TLS key                                                                                |
+| `monitoring.grafana.admin.username`                | Username for the admin user                                                            |
+| `monitoring.grafana.admin.password`                | Password for the admin user                                                            |
+| `monitoring.grafana.ldap.enabled`                  | Whether to enable LDAP                                                                 |
+| `monitoring.grafana.ldap.host`                     | Hostname of LDAP server                                                                |
+| `monitoring.grafana.ldap.port`                     | Port of LDAP server (Has to be `quoted`!)                                              |
+| `monitoring.grafana.ldap.password`                 | Password of LDAP server                                                                |
+| `monitoring.grafana.ldap.bind_dn`                  | Bind DN (username) of the LDAP server                                                  |
+| `monitoring.grafana.ldap.accountBases`             | List of base DNs to discover accounts (Has to have the format `"['a', 'b']"`)          |
+| `monitoring.grafana.ldap.groupBases`               | List of base DNs to discover groups (Has to have the format `"['a', 'b']"`)            |
+| `monitoring.grafana.dashboards.editable`           | Whether dashboards can be edited manually in the UI                                    |
+| `logging.loki.host`                                | Loki ingress hostname                                                                  |
+| `logging.loki.username`                            | Username for Loki                                                                      |
+| `logging.loki.password`                            | Password for Loki                                                                      |
+| `logging.loki.s3.protocol`                         | Protocol used for communicating with S3                                                |
+| `logging.loki.s3.host`                             | Hostname of the S3 object store                                                        |
+| `logging.loki.s3.accessToken`                      | The EC2 accessToken used for authentication with S3                                    |
+| `logging.loki.s3.secret`                           | The secret associated with the accessToken                                             |
+| `logging.loki.s3.bucket`                           | The name of the S3 bucket                                                              |
+| `logging.loki.s3.region`                           | The region in which the S3 bucket is hosted                                            |
+| `logging.loki.tls.cert`                            | TLS certificate                                                                        |
+| `logging.loki.tls.key`                             | TLS key                                                                                |
 
 ### `gerritServers`
 
diff --git a/cfgmgr/abstract.py b/cfgmgr/abstract.py
index 4e5cf61..1b1a3b8 100644
--- a/cfgmgr/abstract.py
+++ b/cfgmgr/abstract.py
@@ -26,8 +26,8 @@
         self.config_path = config_path
 
         self.requires_htpasswd = [
-            ["loki"],
-            ["prometheus", "server"],
+            ["logging", "loki"],
+            ["monitoring", "prometheus", "server"],
         ]
 
     def get_config(self):
diff --git a/charts/grafana/configuration/grafana.ca.secret.yaml b/charts/grafana/configuration/grafana.ca.secret.yaml
index 9853ce7..12e86f1 100644
--- a/charts/grafana/configuration/grafana.ca.secret.yaml
+++ b/charts/grafana/configuration/grafana.ca.secret.yaml
@@ -1,6 +1,6 @@
 #@ load("@ytt:data", "data")
 #@ load("@ytt:base64", "base64")
-#@ if data.values.grafana.ldap.enabled and not data.values.tls.skipVerify:
+#@ if data.values.monitoring.grafana.ldap.enabled and not data.values.tls.skipVerify:
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/charts/grafana/configuration/grafana.secret.yaml b/charts/grafana/configuration/grafana.secret.yaml
index a6b0338..d74a582 100644
--- a/charts/grafana/configuration/grafana.secret.yaml
+++ b/charts/grafana/configuration/grafana.secret.yaml
@@ -7,9 +7,9 @@
   name:  grafana-credentials
   namespace: #@ data.values.namespace
 data:
-  admin-user: #@ base64.encode(data.values.grafana.admin.username)
-  admin-password: #@ base64.encode(data.values.grafana.admin.password)
-  #@ if data.values.grafana.ldap.enabled:
+  admin-user: #@ base64.encode(data.values.monitoring.grafana.admin.username)
+  admin-password: #@ base64.encode(data.values.monitoring.grafana.admin.password)
+  #@ if data.values.monitoring.grafana.ldap.enabled:
   ldap-toml: #@ base64.encode(format_ldap_toml())
   #@ end
 type: Opaque
diff --git a/charts/grafana/configuration/grafana.tls.secret.yaml b/charts/grafana/configuration/grafana.tls.secret.yaml
index d32d491..7a21443 100644
--- a/charts/grafana/configuration/grafana.tls.secret.yaml
+++ b/charts/grafana/configuration/grafana.tls.secret.yaml
@@ -7,5 +7,5 @@
   namespace: #@ data.values.namespace
 type: kubernetes.io/tls
 data:
-  tls.crt: #@ base64.encode(data.values.grafana.tls.cert)
-  tls.key: #@ base64.encode(data.values.grafana.tls.key)
+  tls.crt: #@ base64.encode(data.values.monitoring.grafana.tls.cert)
+  tls.key: #@ base64.encode(data.values.monitoring.grafana.tls.key)
diff --git a/charts/grafana/configuration/ldap.lib.txt b/charts/grafana/configuration/ldap.lib.txt
index 67a3450..66063ea 100644
--- a/charts/grafana/configuration/ldap.lib.txt
+++ b/charts/grafana/configuration/ldap.lib.txt
@@ -2,18 +2,18 @@
 (@ def format_ldap_toml(): -@)
 [[servers]]
 
-host = "(@= data.values.grafana.ldap.host @)"
-port = (@= data.values.grafana.ldap.port @)
+host = "(@= data.values.monitoring.grafana.ldap.host @)"
+port = (@= data.values.monitoring.grafana.ldap.port @)
 use_ssl = true
 start_tls = false
 ssl_skip_verify = (@= "{}".format(data.values.tls.skipVerify).lower() @)
 root_ca_cert = "/etc/secrets/server.ca.crt"
-bind_dn = "(@= data.values.grafana.ldap.bind_dn @)"
-bind_password = "(@= data.values.grafana.ldap.password @)"
+bind_dn = "(@= data.values.monitoring.grafana.ldap.bind_dn @)"
+bind_password = "(@= data.values.monitoring.grafana.ldap.password @)"
 search_filter = "(cn=%s)"
-search_base_dns = (@= data.values.grafana.ldap.accountBases @)
+search_base_dns = (@= data.values.monitoring.grafana.ldap.accountBases @)
 group_search_filter = "(cn=%s)"
-group_search_base_dns = (@= data.values.grafana.ldap.groupBases @)
+group_search_base_dns = (@= data.values.monitoring.grafana.ldap.groupBases @)
 
 [[servers.group_mappings]]
 group_dn = "*"
diff --git a/charts/grafana/grafana.yaml b/charts/grafana/grafana.yaml
index 64b54de..8913de9 100644
--- a/charts/grafana/grafana.yaml
+++ b/charts/grafana/grafana.yaml
@@ -101,7 +101,8 @@
 # podAnnotations: {}
 
 ## Pod Labels
-# podLabels: {}
+podLabels:
+  app: grafana
 
 podPortName: grafana
 
@@ -129,7 +130,7 @@
   labels: {}
   path: /
   hosts:
-  - #@ data.values.grafana.host
+  - #@ data.values.monitoring.grafana.host
   ## Extra paths to prepend to every host configuration. This is useful when working with annotation based services.
   extraPaths: []
   # - path: /*
@@ -139,7 +140,7 @@
   tls:
     - secretName: grafana-server-tls
       hosts:
-      - #@ data.values.grafana.host
+      - #@ data.values.monitoring.grafana.host
 
 resources:
   limits:
@@ -270,7 +271,7 @@
 ## Additional grafana server secret mounts
 # Defines additional mounts with secrets. Secrets must be manually created in the namespace.
 extraSecretMounts:
-#@ if data.values.grafana.ldap.enabled and not data.values.tls.skipVerify:
+#@ if data.values.monitoring.grafana.ldap.enabled and not data.values.tls.skipVerify:
   - name: tls-ca
     mountPath: /etc/secrets
     secretName: grafana-ca
@@ -395,7 +396,7 @@
 ## LDAP Authentication can be enabled with the following values on grafana.ini
 ## NOTE: Grafana will fail to start if the value for ldap.toml is invalid
   auth.ldap:
-    enabled: #@ data.values.grafana.ldap.enabled
+    enabled: #@ data.values.monitoring.grafana.ldap.enabled
     allow_sign_up: true
     config_file: /etc/grafana/ldap.toml
 
@@ -405,7 +406,7 @@
 ## ref: http://docs.grafana.org/installation/configuration/#auth-ldap
 ## ref: http://docs.grafana.org/installation/ldap/#configuration
 ldap:
-  enabled: #@ data.values.grafana.ldap.enabled
+  enabled: #@ data.values.monitoring.grafana.ldap.enabled
   # `existingSecret` is a reference to an existing secret containing the ldap configuration
   # for Grafana in a key `ldap-toml`.
   existingSecret: "grafana-credentials"
@@ -474,7 +475,7 @@
       # disableDelete to activate a import-only behaviour
       disableDelete: true
       # allow updating provisioned dashboards from the UI
-      allowUiUpdates: #@ data.values.grafana.dashboards.editable
+      allowUiUpdates: #@ data.values.monitoring.grafana.dashboards.editable
   datasources:
     enabled: false
     ## Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
diff --git a/charts/loki/configuration/loki.basic-auth.secret.yaml b/charts/loki/configuration/loki.basic-auth.secret.yaml
index 8bc0b5f..33ecbd8 100644
--- a/charts/loki/configuration/loki.basic-auth.secret.yaml
+++ b/charts/loki/configuration/loki.basic-auth.secret.yaml
@@ -6,5 +6,5 @@
   name:  loki-basic-auth
   namespace: #@ data.values.namespace
 data:
-  auth: #@ base64.encode(data.values.loki.htpasswd)
+  auth: #@ base64.encode(data.values.logging.loki.htpasswd)
 type: Opaque
diff --git a/charts/loki/configuration/loki.tls.secret.yaml b/charts/loki/configuration/loki.tls.secret.yaml
index b1a0db8..3a789ca 100644
--- a/charts/loki/configuration/loki.tls.secret.yaml
+++ b/charts/loki/configuration/loki.tls.secret.yaml
@@ -7,5 +7,5 @@
   namespace: #@ data.values.namespace
 type: kubernetes.io/tls
 data:
-  tls.crt: #@ base64.encode(data.values.loki.tls.cert)
-  tls.key: #@ base64.encode(data.values.loki.tls.key)
+  tls.crt: #@ base64.encode(data.values.logging.loki.tls.cert)
+  tls.key: #@ base64.encode(data.values.logging.loki.tls.key)
diff --git a/charts/loki/loki.yaml b/charts/loki/loki.yaml
index f3f63c5..d91343e 100644
--- a/charts/loki/loki.yaml
+++ b/charts/loki/loki.yaml
@@ -14,13 +14,13 @@
     nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required'
     # kubernetes.io/tls-acme: "true"
   hosts:
-    - host: #@ data.values.loki.host
+    - host: #@ data.values.logging.loki.host
       paths:
         - /
   tls:
     - secretName: loki-server-tls
       hosts:
-        - #@ data.values.loki.host
+        - #@ data.values.logging.loki.host
 
 ## Affinity for pod assignment
 ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
@@ -87,7 +87,7 @@
     boltdb:
       directory: /data/loki/index
     aws:
-      s3: #@ "{}://{}:{}@{}/{}".format(data.values.loki.s3.protocol, data.values.loki.s3.accessToken, data.values.loki.s3.secret, data.values.loki.s3.host, data.values.loki.s3.bucket)
+      s3: #@ "{}://{}:{}@{}/{}".format(data.values.logging.loki.s3.protocol, data.values.logging.loki.s3.accessToken, data.values.logging.loki.s3.secret, data.values.logging.loki.s3.host, data.values.logging.loki.s3.bucket)
       s3forcepathstyle: true
   chunk_store_config:
     max_look_back_period: 0
@@ -243,4 +243,4 @@
 # Extra env variables to pass to the loki container
 env:
 - name: AWS_REGION
-  value: #@ data.values.loki.s3.region
+  value: #@ data.values.logging.loki.s3.region
diff --git a/charts/prometheus/configuration/prometheus.basic-auth.secret.yaml b/charts/prometheus/configuration/prometheus.basic-auth.secret.yaml
index 9c213df..6969fa7 100644
--- a/charts/prometheus/configuration/prometheus.basic-auth.secret.yaml
+++ b/charts/prometheus/configuration/prometheus.basic-auth.secret.yaml
@@ -6,5 +6,5 @@
   name:  prometheus-basic-auth
   namespace: #@ data.values.namespace
 data:
-  auth: #@ base64.encode(data.values.prometheus.server.htpasswd)
+  auth: #@ base64.encode(data.values.monitoring.prometheus.server.htpasswd)
 type: Opaque
diff --git a/charts/prometheus/configuration/prometheus.secret.yaml b/charts/prometheus/configuration/prometheus.secret.yaml
index 07757e9..18ec751 100644
--- a/charts/prometheus/configuration/prometheus.secret.yaml
+++ b/charts/prometheus/configuration/prometheus.secret.yaml
@@ -17,7 +17,7 @@
 
   #@ if not data.values.tls.skipVerify:
   server.ca.crt: #@ base64.encode(data.values.tls.caCert)
-  server.crt: #@ base64.encode(data.values.prometheus.server.tls.cert)
-  server.key: #@ base64.encode(data.values.prometheus.server.tls.key)
+  server.crt: #@ base64.encode(data.values.monitoring.prometheus.server.tls.cert)
+  server.key: #@ base64.encode(data.values.monitoring.prometheus.server.tls.key)
   #@ end
 type: Opaque
diff --git a/charts/prometheus/configuration/prometheus.tls.secret.yaml b/charts/prometheus/configuration/prometheus.tls.secret.yaml
index c9a834a..31590fd 100644
--- a/charts/prometheus/configuration/prometheus.tls.secret.yaml
+++ b/charts/prometheus/configuration/prometheus.tls.secret.yaml
@@ -7,5 +7,5 @@
   namespace: #@ data.values.namespace
 type: kubernetes.io/tls
 data:
-  tls.crt: #@ base64.encode(data.values.prometheus.server.tls.cert)
-  tls.key: #@ base64.encode(data.values.prometheus.server.tls.key)
+  tls.crt: #@ base64.encode(data.values.monitoring.prometheus.server.tls.cert)
+  tls.key: #@ base64.encode(data.values.monitoring.prometheus.server.tls.key)
diff --git a/charts/prometheus/prometheus.yaml b/charts/prometheus/prometheus.yaml
index 3623c4a..6aa5823 100644
--- a/charts/prometheus/prometheus.yaml
+++ b/charts/prometheus/prometheus.yaml
@@ -675,7 +675,7 @@
     ## Must be provided if Ingress is enabled
     ##
     hosts:
-    - #@ data.values.prometheus.server.host
+    - #@ data.values.monitoring.prometheus.server.host
     #   - prometheus.domain.com
     #   - domain.com/prometheus
 
@@ -692,7 +692,7 @@
     tls:
     - secretName: prometheus-server-tls
       hosts:
-      - #@ data.values.prometheus.server.host
+      - #@ data.values.monitoring.prometheus.server.host
 
   ## Server Deployment Strategy type
   # strategy:
@@ -1055,12 +1055,12 @@
 alertmanagerFiles:
   alertmanager.yml:
     global:
-      slack_api_url: #@ data.values.prometheus.alertmanager.slack.apiUrl
+      slack_api_url: #@ data.values.monitoring.prometheus.alertmanager.slack.apiUrl
 
     receivers:
       - name: gerrit-admin
         slack_configs:
-          - channel: #@ data.values.prometheus.alertmanager.slack.channel
+          - channel: #@ data.values.monitoring.prometheus.alertmanager.slack.channel
             send_resolved: true
             title: "{{ range .Alerts }}{{ .Annotations.summary }}\n{{ end }}"
             text: "{{ range .Alerts }}{{ .Annotations.description }}\n{{ end }}"
diff --git a/charts/promtail/VERSION b/charts/promtail/VERSION
new file mode 100644
index 0000000..a723ece
--- /dev/null
+++ b/charts/promtail/VERSION
@@ -0,0 +1 @@
+0.22.1
diff --git a/charts/promtail/promtail.yaml b/charts/promtail/promtail.yaml
new file mode 100644
index 0000000..8021291
--- /dev/null
+++ b/charts/promtail/promtail.yaml
@@ -0,0 +1,300 @@
+#@ load("@ytt:data", "data")
+
+## Affinity for pod assignment
+## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+affinity: {}
+
+annotations: {}
+
+# The update strategy to apply to the DaemonSet
+##
+deploymentStrategy: {}
+#  rollingUpdate:
+#    maxUnavailable: 1
+#  type: RollingUpdate
+
+initContainer:
+  enabled: false
+  fsInotifyMaxUserInstances: 128
+
+image:
+  repository: grafana/promtail
+  tag: v1.3.0
+  pullPolicy: IfNotPresent
+
+livenessProbe: {}
+
+loki:
+  serviceName: #@ "loki-{}".format(data.values.namespace)
+  servicePort: 3100
+  serviceScheme: http
+  user: #@ data.values.logging.loki.username
+  password: #@ data.values.logging.loki.password
+
+nameOverride: #@ "promtail-{}".format(data.values.namespace, data.values.namespace)
+
+## Node labels for pod assignment
+## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+nodeSelector: {}
+
+pipelineStages:
+- docker: {}
+
+## Pod Labels
+podLabels: {}
+
+podAnnotations:
+  prometheus.io/scrape: "true"
+  prometheus.io/port: "http-metrics"
+
+## Assign a PriorityClassName to pods if set
+# priorityClassName:
+
+rbac:
+  create: true
+  pspEnabled: true
+
+readinessProbe:
+  failureThreshold: 5
+  httpGet:
+    path: /ready
+    port: http-metrics
+  initialDelaySeconds: 10
+  periodSeconds: 10
+  successThreshold: 1
+  timeoutSeconds: 1
+
+resources:
+  limits:
+    cpu: 200m
+    memory: 128Mi
+  requests:
+    cpu: 100m
+    memory: 128Mi
+
+# Custom scrape_configs to override the default ones in the configmap
+scrapeConfigs:
+  - job_name: kubernetes-pods-monitoring
+    pipeline_stages:
+    - docker: {}
+    kubernetes_sd_configs:
+    - role: pod
+    relabel_configs:
+    - action: labeldrop
+      regex: '__meta_kubernetes_pod_label_app_kubernetes_io_.*'
+    - action: labeldrop
+      regex: '__meta_kubernetes_pod_label_statefulset_kubernetes_io_.*'
+    - action: labeldrop
+      regex: '__meta_kubernetes_pod_label_controller_revision_hash'
+    - action: labeldrop
+      regex: '__meta_kubernetes_pod_label_pod_template_.*'
+    - source_labels:
+      - __meta_kubernetes_pod_label_name
+      target_label: __service__
+    - source_labels:
+      - __meta_kubernetes_pod_node_name
+      target_label: __host__
+    - action: labelmap
+      regex: __meta_kubernetes_pod_label_(.+)
+    - action: replace
+      replacement: $1
+      separator: /
+      source_labels:
+      - __meta_kubernetes_namespace
+      - __meta_kubernetes_pod_label_app
+      - __service__
+      target_label: job
+    - action: replace
+      source_labels:
+      - __meta_kubernetes_namespace
+      target_label: namespace
+    - action: keep
+      regex: #@ data.values.namespace
+      source_labels:
+      - namespace
+    - action: replace
+      source_labels:
+      - release
+      target_label: chart_release
+    - action: replace
+      source_labels:
+      - __meta_kubernetes_pod_name
+      target_label: instance
+    - action: replace
+      source_labels:
+      - __meta_kubernetes_pod_container_name
+      target_label: container_name
+    - replacement: /var/log/pods/*$1/*.log
+      separator: /
+      source_labels:
+      - __meta_kubernetes_pod_uid
+      - __meta_kubernetes_pod_container_name
+      target_label: __path__
+  #@ for gerrit in data.values.gerritServers.kubernetes:
+  - job_name: #@ "kubernetes-pods-gerrit-{}".format(gerrit.namespace)
+    pipeline_stages:
+    - docker: {}
+    kubernetes_sd_configs:
+    - role: pod
+    relabel_configs:
+    - action: labeldrop
+      regex: '__meta_kubernetes_pod_label_pod_template_.*'
+    - source_labels:
+      - __meta_kubernetes_pod_label_name
+      target_label: __service__
+    - source_labels:
+      - __meta_kubernetes_pod_node_name
+      target_label: __host__
+    - action: labelmap
+      regex: __meta_kubernetes_pod_label_(.+)
+    - action: replace
+      replacement: $1
+      separator: /
+      source_labels:
+      - __meta_kubernetes_namespace
+      - __meta_kubernetes_pod_label_app
+      - __service__
+      target_label: job
+    - action: replace
+      source_labels:
+      - __meta_kubernetes_namespace
+      target_label: namespace
+    - action: keep
+      regex: #@ gerrit.namespace
+      source_labels:
+      - namespace
+    - source_labels:
+      - #@ "__meta_kubernetes_pod_label_{}".format(gerrit.label.name)
+      regex: #@ gerrit.label.value
+      action: keep
+    - action: replace
+      source_labels:
+      - release
+      target_label: chart_release
+    - action: replace
+      source_labels:
+      - __meta_kubernetes_pod_name
+      target_label: instance
+    - action: replace
+      source_labels:
+      - __meta_kubernetes_pod_container_name
+      target_label: container_name
+    - replacement: /var/log/pods/*$1/*.log
+      separator: /
+      source_labels:
+      - __meta_kubernetes_pod_uid
+      - __meta_kubernetes_pod_container_name
+      target_label: __path__
+  #@ end
+
+# Custom scrape_configs together with the default ones in the configmap
+extraScrapeConfigs: []
+
+securityContext:
+  readOnlyRootFilesystem: true
+  runAsGroup: 0
+  runAsUser: 0
+
+serviceAccount:
+  create: true
+  name: promtail
+
+## Tolerations for pod assignment
+## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+tolerations:
+- key: node-role.kubernetes.io/master
+  operator: Exists
+  effect: NoSchedule
+
+# Extra volumes to scrape logs from
+volumes:
+- name: docker
+  hostPath:
+    path: /var/lib/docker/containers
+- name: pods
+  hostPath:
+    path: /var/log/pods
+
+# Custom volumes together with the default ones
+extraVolumes: []
+
+volumeMounts:
+- name: docker
+  mountPath: /var/lib/docker/containers
+  readOnly: true
+- name: pods
+  mountPath: /var/log/pods
+  readOnly: true
+
+# Custom volumeMounts together with the default ones
+extraVolumeMounts: []
+
+# Add extra Commandline args while starting up promtail.
+# more info : https://github.com/grafana/loki/pull/1530
+
+extraCommandlineArgs: []
+# example:
+# extraCommandlineArgs:
+#   - -client.external-labels=hostname=$(HOSTNAME)
+
+config:
+  client:
+    # Maximum wait period before sending batch
+    batchwait: 1s
+    # Maximum batch size to accrue before sending, unit is byte
+    batchsize: 102400
+
+    # Maximum time to wait for server to respond to a request
+    timeout: 10s
+
+    backoff_config:
+      # Initial backoff time between retries
+      minbackoff: 100ms
+      # Maximum backoff time between retries
+      maxbackoff: 5s
+      # Maximum number of retries when sending batches, 0 means infinite retries
+      maxretries: 20
+
+    # The labels to add to any time series or alerts when communicating with loki
+    external_labels: {}
+
+  server:
+    http_listen_port: 3101
+
+  positions:
+    filename: /run/promtail/positions.yaml
+  target_config:
+    # Period to resync directories being watched and files being tailed
+    sync_period: 10s
+
+serviceMonitor:
+  enabled: false
+  interval: ""
+  additionalLabels: {}
+  # scrapeTimeout: 10s
+
+# Extra env variables to pass to the promtail container
+env: []
+
+# enable and configure if using the syslog scrape config
+syslogService:
+  enabled: false
+  type: ClusterIP
+  port: 1514
+  ## Specify the nodePort value for the LoadBalancer and NodePort service types.
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
+  ##
+  # nodePort:
+  ## Provide any additional annotations which may be required. This can be used to
+  ## set the LoadBalancer service type to internal only.
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
+  ##
+  annotations: {}
+  labels: {}
+  ## Use loadBalancerIP to request a specific static IP,
+  ## otherwise leave blank
+  ##
+  loadBalancerIP:
+  # loadBalancerSourceRanges: []
+  ## Set the externalTrafficPolicy in the Service to either Cluster or Local
+  # externalTrafficPolicy: Cluster
diff --git a/config.yaml b/config.yaml
index 52e98bd..41f2057 100644
--- a/config.yaml
+++ b/config.yaml
@@ -19,47 +19,49 @@
 tls:
   skipVerify: true
   caCert:
-prometheus:
-  server:
-    host: prometheus.example.com
-    username:
-    password:
+monitoring:
+  prometheus:
+    server:
+      host: prometheus.example.com
+      username:
+      password:
+      tls:
+        cert:
+        key:
+    alertmanager:
+      slack:
+        apiUrl: https://hooks.slack.com/services/xxx/xxx
+        channel: '#alerts'
+  grafana:
+    host: grafana.example.com
     tls:
       cert:
       key:
-  alertmanager:
-    slack:
-      apiUrl: https://hooks.slack.com/services/xxx/xxx
-      channel: '#alerts'
-loki:
-  host: loki.example.com
-  username:
-  password:
-  s3:
-    protocol: https
-    host: s3.eu-de-1.example.com
-    accessToken: abcd
-    secret: "1234"
-    bucket: bucket
-    region: eu-de-1
-  tls:
-    cert:
-    key:
-grafana:
-  host: grafana.example.com
-  tls:
-    cert:
-    key:
-  admin:
-    username: admin
-    password: secret
-  ldap:
-    enabled: false
-    host:
-    port: ""
+    admin:
+      username: admin
+      password: secret
+    ldap:
+      enabled: false
+      host:
+      port: ""
+      password:
+      bind_dn:
+      accountBases: "[]"
+      groupBases: "[]"
+    dashboards:
+      editable: false
+logging:
+  loki:
+    host: loki.example.com
+    username:
     password:
-    bind_dn:
-    accountBases: "[]"
-    groupBases: "[]"
-  dashboards:
-    editable: false
+    s3:
+      protocol: https
+      host: s3.eu-de-1.example.com
+      accessToken: abcd
+      secret: "1234"
+      bucket: bucket
+      region: eu-de-1
+    tls:
+      cert:
+      key:
diff --git a/promtail/promtail.yaml b/promtail/promtailLocalConfig.yaml
similarity index 92%
rename from promtail/promtail.yaml
rename to promtail/promtailLocalConfig.yaml
index a56e625..d17d038 100644
--- a/promtail/promtail.yaml
+++ b/promtail/promtailLocalConfig.yaml
@@ -10,15 +10,15 @@
   filename: #@ "{}/positions.yaml".format(data.values.gerritServers.other[i].promtail.storagePath)
 
 clients:
-  - url: #@ "https://{}/loki/api/v1/push".format(data.values.loki.host)
+  - url: #@ "https://{}/loki/api/v1/push".format(data.values.logging.loki.host)
     tls_config:
       insecure_skip_verify: #@ data.values.tls.skipVerify
       #@ if not data.values.tls.skipVerify:
       ca_file: #@ "{}/promtail.ca.crt".format(data.values.gerritServers.other[i].promtail.storagePath)
       #@ end
     basic_auth:
-      username: #@ data.values.loki.username
-      password: #@ data.values.loki.password
+      username: #@ data.values.logging.loki.username
+      password: #@ data.values.logging.loki.password
 scrape_configs:
 - job_name: gerrit_error
   static_configs:
diff --git a/subcommands/_globals.py b/subcommands/_globals.py
index 43f5ffe..987b5bd 100644
--- a/subcommands/_globals.py
+++ b/subcommands/_globals.py
@@ -16,4 +16,5 @@
     "grafana": "stable/grafana",
     "loki": "loki/loki",
     "prometheus": "stable/prometheus",
+    "promtail": "loki/promtail",
 }
diff --git a/subcommands/install.py b/subcommands/install.py
index cc50b95..e5fa1fa 100644
--- a/subcommands/install.py
+++ b/subcommands/install.py
@@ -14,7 +14,9 @@
 
 import os.path
 import stat
+import shutil
 import subprocess
+import sys
 import zipfile
 
 import requests
@@ -26,6 +28,7 @@
 TEMPLATES = [
     "charts/namespace.yaml",
     "charts/prometheus",
+    "charts/promtail",
     "charts/loki",
     "charts/grafana",
     "promtail",
@@ -79,7 +82,7 @@
     if not os.path.exists(os.path.join(output_dir, "promtail")):
         os.mkdir(os.path.join(output_dir, "promtail"))
 
-    with open(os.path.join(output_dir, "promtail.yaml")) as f:
+    with open(os.path.join(output_dir, "promtailLocalConfig.yaml")) as f:
         for promtail_config in yaml.load_all(f, Loader=yaml.SafeLoader):
             with open(
                 os.path.join(
@@ -94,7 +97,7 @@
             ) as f:
                 yaml.dump(promtail_config, f)
 
-    os.remove(os.path.join(output_dir, "promtail.yaml"))
+    os.remove(os.path.join(output_dir, "promtailLocalConfig.yaml"))
 
     if not config["tls"]["skipVerify"]:
         try:
@@ -145,7 +148,7 @@
         command += ["-f", template]
 
     command += [
-        "--output-directory",
+        "--output-files",
         output_dir,
         "--ignore-unknown-comments",
         "-f",
@@ -229,13 +232,30 @@
 
     if not os.path.exists(output_dir):
         os.mkdir(output_dir)
+    elif os.listdir(output_dir):
+        while True:
+            response = input(
+                (
+                    "Output directory already exists. This may lead to file conflicts "
+                    "and unwanted configuration applied to the cluster. Do you want "
+                    "to empty the directory? [y/n] "
+                )
+            )
+            if response == "y":
+                shutil.rmtree(output_dir)
+                os.mkdir(output_dir)
+                break
+            if response == "n":
+                print("Aborting installation. Please provide empty directory.")
+                sys.exit(1)
+            print("Unknown input.")
 
     _run_ytt(config, output_dir)
 
     namespace = config_manager.get_config()["namespace"]
     _create_dashboard_configmaps(output_dir, namespace)
 
-    if os.path.exists(os.path.join(output_dir, "promtail.yaml")):
+    if os.path.exists(os.path.join(output_dir, "promtailLocalConfig.yaml")):
         _create_promtail_configs(config, output_dir)
         if not dryrun:
             _download_promtail(output_dir)