This is a highly configurable logstash (1.4.2) image running Elasticsearch (1.1.1) and Kibana (3.0.1).

To run the image, you have to first decide on one of three Elasticsearch configurations:

• Use the embedded Elasticsearch server
• Use a linked container running Elasticsearch
• Use an external Elasticsearch server

By default, an example logstash.conf will be downloaded using wget and used in your container.

$ docker run -d \
  -p 9292:9292 \
  -p 9200:9200 \
  pblittle/docker-logstash

To use your own config file, set the LOGSTASH_CONFIG_URL environment variable using the -e flag as follows:

$ docker run -d \
  -e LOGSTASH_CONFIG_URL=<your_logstash_config_url> \
  -p 9292:9292 \
  -p 9200:9200 \
  pblittle/docker-logstash

To use config files from the local file system, mount the directory as a volume using the -v flag. Any file in /opt/logstash/conf.d in the container will get loaded by logstash.

$ docker run -d \
  -v <your_logstash_config_dir>:/opt/logstash/conf.d \
  -p 9292:9292 \
  -p 9200:9200 \
  pblittle/docker-logstash

If you want to link to container running Elasticsearch rather than use the embedded Elasticsearch server:

$ docker run -d \
  -e LOGSTASH_CONFIG_URL=<your_logstash_config_url> \
  --link <your_es_container_name>:es \
  -p 9292:9292 \
  pblittle/docker-logstash

To have the linked Elasticsearch container's bind_host and port automatically detected, you will need to create an ES_HOST and ES_PORT placeholder in the elasticsearch definition in your logstash config file. For example:

output {
  elasticsearch {
    bind_host => "ES_HOST"
    port => "ES_PORT"
  }
}

I have created an example logstash_linked.conf which includes the ES_HOST and ES_PORT placeholders to serve as an example.

If you are using an external Elasticsearch server rather than the embedded server or a linked container, simply provide a configuration file with the Elasticsearch endpoints already configured:

$ docker run -d \
  -e LOGSTASH_CONFIG_URL=<your_logstash_config_url> \
  -p 9292:9292 \
  pblittle/docker-logstash

You can now verify the logstash installation by visiting the prebuilt logstash dashboard:

http:https://<your_container_ip>:9292/index.html#/dashboard/file/logstash.json

If you prefer to build from source rather than use the pblittle/docker-logstash trusted build published to the public Docker Registry, execute the following:

$ git clone https://github.com/pblittle/docker-logstash.git
$ cd docker-logstash

If you are using Vagrant, you can build and run the container in a VM by executing:

$ vagrant up
$ vagrant ssh
$ cd /vagrant

From there, build and run a container using the newly created virtual machine:

$ make build
$ make <options> run

Verify the logstash installation by visiting the prebuilt logstash dashboard running in the newly created container.

Special shoutout to @ehazlett's excellent post, logstash and Kibana via Docker.

1. Fork it
2. Create your feature branch (git checkout -b my-new-feature)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin my-new-feature)
5. Create new Pull Request

This application is distributed under the Apache License, Version 2.0.