diff --git a/roles/logstash/README.md b/roles/logstash/README.md
index c1be4902..1d7964c6 100644
--- a/roles/logstash/README.md
+++ b/roles/logstash/README.md
@@ -93,6 +93,9 @@ Run only parts of the role with `--tags`:
 | `logstash_forwarder_queue_type` | `str` | `"memory"` | `memory`, `persisted` | Queue type for the default Elasticsearch forwarder pipeline. Use "persisted" for an on-disk persistent queue. |
 | `logstash_forwarder_queue_max_bytes` | `str` | `"1gb"` | — | Maximum queue size for the default Elasticsearch forwarder pipeline. |
 | `logstash_redis_password` | `str` | N/A | — | Password used when the simple inputs/outputs connect to Redis. Unset by default. |
+| `logstash_redis_input_host` | `str` | `"localhost"` | — | Redis host that simple pipeline inputs (and the default forwarder input) read from. |
+| `logstash_redis_output_host` | `str` | `"localhost"` | — | Redis host that simple pipeline outputs (and the default input pipeline) write to. |
+| `logstash_redis_tls` | `bool` | `false` | — | Enable TLS on the simple Redis inputs/outputs (`ssl`/`ssl_enabled`). |
 | `logstash_elasticsearch` | `list` of `str` | N/A | — | Elasticsearch hosts for the default output. Defaults to the nodes from the elasticsearch group, or localhost when used standalone. |
 | `logstash_validate_after_inactivity` | `str` | `"300"` | — | Seconds Logstash waits before validating a previously idle connection to Elasticsearch. |
 | `logstash_sniffing` | `bool` | `false` | — | Enable sniffing for additional Elasticsearch nodes. |
diff --git a/roles/logstash/defaults/main.yml b/roles/logstash/defaults/main.yml
index d114438d..a347085b 100644
--- a/roles/logstash/defaults/main.yml
+++ b/roles/logstash/defaults/main.yml
@@ -43,6 +43,12 @@ logstash_input_queue_type: memory
 logstash_input_queue_max_bytes: 1gb
 logstash_forwarder_queue_type: memory
 logstash_forwarder_queue_max_bytes: 1gb
+
+# redis connection for simple pipeline inputs/outputs
+logstash_redis_input_host: localhost
+logstash_redis_output_host: localhost
+logstash_redis_tls: false
+
 logstash_sniffing: false
 
 # logstash role / user
diff --git a/roles/logstash/meta/argument_specs.yml b/roles/logstash/meta/argument_specs.yml
index 95ac3641..9c9222a4 100644
--- a/roles/logstash/meta/argument_specs.yml
+++ b/roles/logstash/meta/argument_specs.yml
@@ -253,6 +253,21 @@ argument_specs:
         type: str
         description: Password used when the simple inputs/outputs connect to Redis. Unset by default.
 
+      logstash_redis_input_host:
+        type: str
+        default: localhost
+        description: Redis host that simple pipeline inputs (and the default forwarder input) read from.
+
+      logstash_redis_output_host:
+        type: str
+        default: localhost
+        description: Redis host that simple pipeline outputs (and the default input pipeline) write to.
+
+      logstash_redis_tls:
+        type: bool
+        default: false
+        description: Enable TLS on the simple Redis inputs/outputs (`ssl`/`ssl_enabled`).
+
       # ----- Elasticsearch connection / output -----
       logstash_elasticsearch:
         type: list
diff --git a/roles/logstash/templates/redis-input.conf.j2 b/roles/logstash/templates/redis-input.conf.j2
index 0481dc53..62bbb909 100644
--- a/roles/logstash/templates/redis-input.conf.j2
+++ b/roles/logstash/templates/redis-input.conf.j2
@@ -1,6 +1,9 @@
 input {
   redis {
-    host => "localhost"
+    host => "{{ logstash_redis_input_host }}"
+{% if logstash_redis_tls | bool %}
+    ssl => true
+{% endif %}
     data_type => "list"
     key => "forwarder"
 {% if logstash_redis_password is defined %}
diff --git a/roles/logstash/templates/redis-output.conf.j2 b/roles/logstash/templates/redis-output.conf.j2
index 59c5a578..e47b4fa8 100644
--- a/roles/logstash/templates/redis-output.conf.j2
+++ b/roles/logstash/templates/redis-output.conf.j2
@@ -10,7 +10,10 @@ filter {
 {% endif %}
 output {
   redis {
-    host => "localhost"
+    host => "{{ logstash_redis_output_host }}"
+{% if logstash_redis_tls | bool %}
+    ssl_enabled => true
+{% endif %}
     data_type => "list"
     key => "input"
 {% if logstash_beats_input_congestion is defined %}    congestion_threshold => {{ logstash_beats_input_congestion }}{% endif %}
diff --git a/roles/logstash/templates/simple-input.conf.j2 b/roles/logstash/templates/simple-input.conf.j2
index ce871c7f..0144bbe4 100644
--- a/roles/logstash/templates/simple-input.conf.j2
+++ b/roles/logstash/templates/simple-input.conf.j2
@@ -3,7 +3,10 @@ input {
 
 # {{ input.name }} input
   redis {
-    host => "localhost"
+    host => "{{ logstash_redis_input_host }}"
+{% if logstash_redis_tls | bool %}
+    ssl => true
+{% endif %}
     data_type => "list"
     key => "{{ input.key }}"
 {% if logstash_redis_password is defined %}
diff --git a/roles/logstash/templates/simple-output.conf.j2 b/roles/logstash/templates/simple-output.conf.j2
index 4b3ace63..ad1564f3 100644
--- a/roles/logstash/templates/simple-output.conf.j2
+++ b/roles/logstash/templates/simple-output.conf.j2
@@ -16,7 +16,10 @@ output {
 {% if not loop.first and pipelinename.exclusive | bool %}else {% endif %}{% if (not loop.last and pipelinename.exclusive | bool) or not pipelinename.exclusive %}if {% endif %}{% if output.condition is defined %}{{ output.condition }} {% endif %}{
 {% endif %}
   redis {
-    host => "localhost"
+    host => "{{ logstash_redis_output_host }}"
+{% if logstash_redis_tls | bool %}
+    ssl_enabled => true
+{% endif %}
     data_type => "list"
     key => "{{ output.key }}"
 {% if logstash_redis_password is defined %}