Some parts of the /var/log/cloud-init-output.log file aren't particularly useful to have in ELK and make it harder to view and debug the startup logs for an app. This includes things like public keys.
Should some of this be filtered out?
There's an example of the cloud init output logs for DCR here