This configuration for heka ships apache logs stored in /var/log/syslog/systems/web to mozdef.
/var/log/syslog/systems/web
To run it:
rm -rf /var/cache/hekad/* hekad -config=heka.toml