diff --git a/docker/data/logstash/env2yaml/env2yaml.go b/docker/data/logstash/env2yaml/env2yaml.go
index 6b3bd346d..81029fe78 100644
--- a/docker/data/logstash/env2yaml/env2yaml.go
+++ b/docker/data/logstash/env2yaml/env2yaml.go
@@ -59,6 +59,7 @@ func normalizeSetting(setting string) (string, error) {
 		"pipeline.java_execution",
 		"pipeline.ecs_compatibility",
 		"pipeline.plugin_classloaders",
+		"pipeline.separate_logs",
 		"path.config",
 		"config.string",
 		"config.test_and_exit",
@@ -81,6 +82,7 @@ func normalizeSetting(setting string) (string, error) {
 		"path.dead_letter_queue",
 		"http.host",
 		"http.port",
+		"http.enabled",
 		"log.level",
 		"log.format",
 		"modules",
@@ -92,6 +94,10 @@ func normalizeSetting(setting string) (string, error) {
 		"xpack.monitoring.elasticsearch.username",
 		"xpack.monitoring.elasticsearch.password",
 		"xpack.monitoring.elasticsearch.proxy",
+		"xpack.monitoring.elasticsearch.api_key",
+		"xpack.monitoring.elasticsearch.cloud_auth",
+		"xpack.monitoring.elasticsearch.cloud_id",
+		"xpack.monitoring.elasticsearch.sniffing",
 		"xpack.monitoring.elasticsearch.ssl.certificate_authority",
 		"xpack.monitoring.elasticsearch.ssl.verification_mode",
 		"xpack.monitoring.elasticsearch.ssl.truststore.path",
@@ -105,6 +111,10 @@ func normalizeSetting(setting string) (string, error) {
 		"xpack.management.elasticsearch.username",
 		"xpack.management.elasticsearch.password",
 		"xpack.management.elasticsearch.proxy",
+		"xpack.management.elasticsearch.api_key",
+		"xpack.management.elasticsearch.cloud_auth",
+		"xpack.management.elasticsearch.cloud_id",
+		"xpack.management.elasticsearch.sniffing",
 		"xpack.management.elasticsearch.ssl.certificate_authority",
 		"xpack.management.elasticsearch.ssl.verification_mode",
 		"xpack.management.elasticsearch.ssl.truststore.path",