logstash_example.md

1. create a file: docker-elk/logstash/config/mylog.log
2. change docker-compose to be:

  logstash:
    build:
      context: logstash/
      args:
        ELK_VERSION: $ELK_VERSION
    volumes:
      - ./logstash/config:/usr/share/logstash/config
      - ./logstash/pipeline:/usr/share/logstash/pipeline:ro
    ports:
      - "5000:5000"
      - "9600:9600"
    environment:
      LS_JAVA_OPTS: "-Xmx256m -Xms256m"
    networks:
      - elk
    depends_on:
      - elasticsearch

3. change the docker-elk/logstash/pipeline/logstash.conf to be:

input {
    file {
        path => "/usr/share/logstash/config/mylog.log"
    }
}

output {
      elasticsearch {
          hosts => ["elasticsearch:9200"]
      }

      stdout { codec => rubydebug }
  }

4. run docker exec -it docker-elk_logstash_1 echo test >> /usr/share/logstash/config/mylog.log
5. open kibana screen and add logstash index that just now added under management > index patterns > create index pattern.