This is a fork of pblittle's docker-logstash that simply puts elasticsearch on port 9500-9600 for reasons you may not want to admit!

---

This is a logstash (1.4.2) image that is configurable to run using either the embedded elasticsearch or an elasticsearch node running in a separate container.

To fetch and start a container running logstash (1.4.2), elasticsearch (1.1.1) and Kibana 3 (3.0.1), simply:

docker run -d \
  --name logstash \
  -p 514:514 \
  -p 9500:9500 \
  -p 9292:9292 \
  mikesplain/logstash

If you want to link to an external elasticsearch container rather than the embedded server, add a link flag with your existing elasticsearch container's name. For example, to link to a container named elasticsearch:

docker run -d \
  --name logstash \
  -link elasticsearch:es \
  -p 514:514 \
  -p 9292:9292 \
  mikesplain/logstash

In addition to the link, if you want your elasticsearch node's bind_host and port automatically detected, you will need to set ES_HOST and ES_PORT placeholders in your elasticsearch definition in your logstash config file.

output {
  stdout {
    codec => rubydebug
    debug => true
    debug_format => "json"
  }

  elasticsearch {
    bind_host => "ES_HOST"
    port => "ES_PORT"
  }
}

Alternatively, you can replace the placeholder values with the real elasticsearch bind_host and port values.

Without any configuration changes, an example logstash.conf will be created for you. You can override the example config by passing a LOGSTASH_CONFIG_URL env var in your docker run command using a -e flag pointing to your config file.

docker run -d \
  --name logstash \
  -p 514:514 \
  -p 9292:9292 \
  -e LOGSTASH_CONFIG_URL=https://gist.github.com/pblittle/8778567/raw/logstash.conf \
  mikesplain/logstash

To build the image locally using Vagrant, perform the following steps from the project root:

vagrant up
vagrant ssh
cd /vagrant

From there, to build and create a running container from the newly created image:

make build
make run

Special shoutout to ehazlett's excellent post, Logstash and Kibana3 via Docker, explaining the big picture.