diff --git a/x-pack/legacy/plugins/epm/server/lib/agent/agent.test.ts b/x-pack/legacy/plugins/epm/server/lib/agent/agent.test.ts
new file mode 100644
index 0000000000000..f868b7d6d53f4
--- /dev/null
+++ b/x-pack/legacy/plugins/epm/server/lib/agent/agent.test.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import path from 'path';
+import * as yaml from 'js-yaml';
+import fs from 'fs';
+import { createInput } from './agent';
+
+test('test converting input and manifest into template', () => {
+  const manifest = yaml.safeLoad(
+    fs.readFileSync(path.join(__dirname, 'tests/manifest.yml'), 'utf8')
+  );
+
+  const inputTemplate = fs.readFileSync(path.join(__dirname, 'tests/input.yml'), 'utf8');
+  const output = createInput(manifest, inputTemplate);
+
+  // Golden file path
+  const generatedFile = path.join(__dirname, './tests/input.generated.yaml');
+
+  // Regenerate the file if `-generate` flag is used
+  if (process.argv.includes('-generate')) {
+    fs.writeFileSync(generatedFile, output);
+  }
+
+  const outputData = fs.readFileSync(generatedFile, 'utf-8');
+
+  // Check that content file and generated file are equal
+  expect(outputData).toBe(output);
+});
diff --git a/x-pack/legacy/plugins/epm/server/lib/agent/agent.ts b/x-pack/legacy/plugins/epm/server/lib/agent/agent.ts
new file mode 100644
index 0000000000000..88d2507df8f21
--- /dev/null
+++ b/x-pack/legacy/plugins/epm/server/lib/agent/agent.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Handlebars from 'handlebars';
+
+interface Manifest {
+  vars: VarsEntry[];
+}
+
+interface VarsEntry {
+  name: string;
+  default: string;
+}
+/**
+ * This takes a manifest object as input and merges it with the input template.
+ * It returns the resolved template as a string.
+ */
+export function createInput(manifest: Manifest, inputTemplate: string): string {
+  const view: Record<VarsEntry['name'], VarsEntry['default']> = {};
+
+  for (const v of manifest.vars) {
+    view[v.name] = v.default;
+  }
+
+  const template = Handlebars.compile(inputTemplate);
+  return template(view);
+}
diff --git a/x-pack/legacy/plugins/epm/server/lib/agent/tests/input.generated.yaml b/x-pack/legacy/plugins/epm/server/lib/agent/tests/input.generated.yaml
new file mode 100644
index 0000000000000..451ed554ce259
--- /dev/null
+++ b/x-pack/legacy/plugins/epm/server/lib/agent/tests/input.generated.yaml
@@ -0,0 +1,5 @@
+type: log
+paths:
+  - "/var/log/nginx/access.log*"
+
+tags: nginx
diff --git a/x-pack/legacy/plugins/epm/server/lib/agent/tests/input.yml b/x-pack/legacy/plugins/epm/server/lib/agent/tests/input.yml
new file mode 100644
index 0000000000000..65a23fc2fa9ad
--- /dev/null
+++ b/x-pack/legacy/plugins/epm/server/lib/agent/tests/input.yml
@@ -0,0 +1,7 @@
+type: log
+paths:
+{{#each paths}}
+  - "{{this}}"
+{{/each}}
+
+tags: {{tags}}
diff --git a/x-pack/legacy/plugins/epm/server/lib/agent/tests/manifest.yml b/x-pack/legacy/plugins/epm/server/lib/agent/tests/manifest.yml
new file mode 100644
index 0000000000000..46a38179fe132
--- /dev/null
+++ b/x-pack/legacy/plugins/epm/server/lib/agent/tests/manifest.yml
@@ -0,0 +1,20 @@
+title: Nginx Acess Logs
+release: beta
+type: logs
+ingest_pipeline: default
+
+vars:
+  - name: paths
+    # Should we define this as array? How will the UI best make sense of it?
+    type: textarea
+    default:
+      - /var/log/nginx/access.log*
+    # I suggest to use ECS fields for this config options here: https://github.com/elastic/ecs/blob/master/schemas/os.yml
+    # This would need to be based on a predefined definition on what can be filtered on
+    os.darwin:
+      - /usr/local/var/log/nginx/access.log*
+    os.windows:
+      - c:/programdata/nginx/logs/*access.log*
+  - name: tags
+    default: [nginx]
+    type: text