diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64e2be7..acd7c0c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,7 +4,7 @@ on: push
 
 defaults:
   run:
-    working-directory: examples
+    working-directory: examples/elasticsearch
 
 jobs:
   check:
diff --git a/README.md b/README.md
index 98e02d9..cc27eba 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ module "functionbeat" {
 
 ## Advanced example ##
 
-Head over to `example/elasticsearch.tf` to get an more advanced example.
+Head over to `example/elasticsearch/elasticsearch.tf`  or `example/logstash/logstash.tf` to get an more advanced example.
 
 ## Usage ##
 
@@ -162,7 +162,7 @@ This module exposes:
 In ``examples/`` there is an advanced example.
 Simply checkout the module source and
 ```shell
-cd examples/
+cd examples/elasticsearch
 terrafrom init
 terraform apply -auto-approve
 ```
diff --git a/examples/elasticsearch.tf b/examples/elasticsearch/elasticsearch.tf
similarity index 99%
rename from examples/elasticsearch.tf
rename to examples/elasticsearch/elasticsearch.tf
index 8a3a86d..8ea4f0d 100644
--- a/examples/elasticsearch.tf
+++ b/examples/elasticsearch/elasticsearch.tf
@@ -38,7 +38,7 @@ resource "aws_security_group" "functionbeat_securitygroup" {
 }
 
 module "functionbeat" {
-  source = "../"
+  source = "../.."
 
   application_name     = "crazy-test-module"
   functionbeat_version = "7.17.1"
diff --git a/examples/logstash.tf b/examples/logstash/logstash.tf
similarity index 94%
rename from examples/logstash.tf
rename to examples/logstash/logstash.tf
index e9acfce..78d0171 100644
--- a/examples/logstash.tf
+++ b/examples/logstash/logstash.tf
@@ -38,7 +38,7 @@ resource "aws_security_group" "functionbeat_securitygroup" {
 }
 
 module "functionbeat" {
-  source = "../"
+  source = "../.."
 
   application_name     = "crazy-test-module"
   functionbeat_version = "7.17.1"
@@ -53,8 +53,8 @@ module "functionbeat" {
     }
 
     output_logstash = {
-      hosts       = ["10.0.0.1:5044", "10.0.0.2:5044"]
-      ssl.enabled = false
+      hosts         = ["10.0.0.1:5044", "10.0.0.2:5044"]
+      "ssl.enabled" = false
     }
   }