diff --git a/ansible/roles/common/tasks/config.yml b/ansible/roles/common/tasks/config.yml
index 8eccc94f20..1f4248de06 100644
--- a/ansible/roles/common/tasks/config.yml
+++ b/ansible/roles/common/tasks/config.yml
@@ -65,12 +65,14 @@
 
 - name: Copying over fluentd filter config files
   template:
-    src: "conf/filter/{{ item }}.conf.j2"
-    dest: "{{ node_config_directory }}/fluentd/filter/{{ item }}.conf"
+    src: "conf/filter/{{ item.src }}.conf.j2"
+    dest: "{{ node_config_directory }}/fluentd/filter/{{ item.dest }}.conf"
   register: fluentd_filter
   with_items:
-    - "00-record_transformer"
-    - "01-rewrite"
+    - src: 00-record_transformer
+      dest: 00-record_transformer
+    - src: "{{ '01-rewrite-0.14' if kolla_base_distro in ['debian', 'ubuntu'] else '01-rewrite-0.12' }}"
+      dest: 01-rewrite
   notify:
     - Restart fluentd container
 
diff --git a/ansible/roles/common/templates/conf/filter/01-rewrite.conf.j2 b/ansible/roles/common/templates/conf/filter/01-rewrite-0.12.conf.j2
similarity index 100%
rename from ansible/roles/common/templates/conf/filter/01-rewrite.conf.j2
rename to ansible/roles/common/templates/conf/filter/01-rewrite-0.12.conf.j2
diff --git a/ansible/roles/common/templates/conf/filter/01-rewrite-0.14.conf.j2 b/ansible/roles/common/templates/conf/filter/01-rewrite-0.14.conf.j2
new file mode 100644
index 0000000000..30467357a4
--- /dev/null
+++ b/ansible/roles/common/templates/conf/filter/01-rewrite-0.14.conf.j2
@@ -0,0 +1,154 @@
+<match kolla.var.log.kolla.*.*.log>
+    @type rewrite_tag_filter
+    capitalize_regex_backreference yes
+  <rule>
+    key     programname
+    pattern ^(cinder-api-access|cloudkitty-api-access|gnocchi-api-access|horizon-access|keystone-apache-admin-access|keystone-apache-public-access|placement-api-access|panko-api-access)$
+    tag apache_access
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(aodh_wsgi_access|barbican-api|zun_api_wsgi_access)$
+    tag wsgi_access
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(nova-api|nova-compute|nova-compute-ironic|nova-conductor|nova-consoleauth|nova-manage|nova-novncproxy|nova-scheduler|nova-placement-api|placement-api|privsep-helper)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(sahara-api|sahara-engine)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(neutron-server|neutron-openvswitch-agent|neutron-ns-metadata-proxy|neutron-metadata-agent|neutron-l3-agent|neutron-dhcp-agent)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(magnum-conductor|magnum-api)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(keystone)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(heat-engine|heat-api|heat-api-cfn)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(glance-api|glance-registry)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(cloudkitty-storage-init|cloudkitty-processor|cloudkitty-dbsync|cloudkitty-api)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(ceilometer-polling|ceilometer-agent-notification)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(barbican-worker|barbican-keystone-listener|barbican-db-manage|app)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(aodh-notifier|aodh-listener|aodh-evaluator|aodh-dbsync)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(cinder-api|cinder-scheduler|cinder-manage|cinder-volume|cinder-backup|privsep-helper)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(mistral-server)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(designate-api|designate-central|designate-manage|designate-mdns|designate-sink|designate-worker)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(manila-api|manila-data|manila-manage|manila-share|manila-scheduler)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(trove-api|trove-conductor|trove-manage|trove-taskmanager)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(congress-server)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(murano-api|murano-engine)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(senlin-api|senlin-engine)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(watcher-api|watcher-applier|watcher-db-manage|watcher-decision-engine)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(freezer-api|freezer-api_access|freezer-manage)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(octavia-api|octavia-health-manager|octavia-housekeeping|octavia-worker)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(zun-api|zun-compute)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(kuryr-server)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(gnocchi-api|gnocchi-statsd|gnocchi-metricd|gnocchi-upgrade)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(ironic-api|ironic-conductor)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(panko-api|panko-dbsync)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(tacker-server|tacker-conductor)$
+    tag openstack_python
+  </rule>
+</match>