diff --git a/roles/filebeat/defaults/main.yml b/roles/filebeat/defaults/main.yml
index 42fe68408..2d4e820c2 100644
--- a/roles/filebeat/defaults/main.yml
+++ b/roles/filebeat/defaults/main.yml
@@ -11,7 +11,9 @@ filebeat_apt_url: "https://artifacts.elastic.co/packages/oss-{{ filebeat_major_v
 #     - "/opt/openconext/logs/log_logins/prod_sc/eb-authentication.log"
 #    fields:
 #     - "env: prod_sc"
-#    logstash_hosts: '["logstashserver.example.com:5044","logstashserver2.example.com:5044"]'
+#    logstash_hosts:
+#      - "logstashserver.example.com:5044"
+#      - "logstashserver2.example.com:5044"
 #    logstash_ca_path: "/etc/pki/tls/certs"
 #   logstash_ca: "{{ logstash_ca_path }}/logstash-prod-ca.pem"
 #    cacert_content: |
diff --git a/roles/filebeat/templates/filebeat.yml.j2 b/roles/filebeat/templates/filebeat.yml.j2
index 871709574..b7a78f3f5 100644
--- a/roles/filebeat/templates/filebeat.yml.j2
+++ b/roles/filebeat/templates/filebeat.yml.j2
@@ -34,7 +34,7 @@ processors:
    - drop_fields:
        fields: ["host"]
 output.logstash:
-  hosts: {{ item.logstash_hosts }}
+  hosts: {{ item.logstash_hosts  | to_json }}
 {% if item.logstash_ca is defined %}
   ssl.certificate_authorities: ["{{ item.logstash_ca }}"]
 {% endif %}