49-ship-syslog.conf

# /etc/rsyslog.d/49-ship-syslog.conf
*.*;syslog;auth,authpriv.none action(
  type="omfwd"
  Target="logstash.marathon.mesos"
  Port="5001"
  Protocol="tcp"
)

logstash.conf

input {
  tcp {
    port => 5000
    type => docker
  }

  tcp {
    port => 5001
    type => rsyslog
  }
}

filter {
  if [type] == "rsyslog" {
    grok {
      match => { "message" => "<%{POSINT:priority}>%{TIMESTAMP_ISO8601:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }

    date {
      match => [ "syslog_timestamp", "ISO8601" ]
      remove_field => [ "syslog_timestamp" ]
    }

    mutate {
      replace => [ "message", "%{syslog_message}" ]
      remove_field => [ "syslog_message" ]
    }
  }
}

output {
  elasticsearch { hosts => [
    "elasticsearch.marathon.mesos:9200"
    ]
  }
}

mesos-dns-config.json

{
  "zk": "zk://192.168.192.101:2181,192.168.192.102:2181,192.168.192.103:2181/mesos",
  "masters": ["192.168.192.101:5050", "192.168.192.102:5050", "192.168.192.103:5050"],
  "refreshSeconds": 60,
  "ttl": 60,
  "domain": "mesos",
  "port": 53,
  "resolvers": ["10.0.2.3"],
  "timeout": 5,
  "httpon": true,
  "dnson": true,
  "httpport": 8123,
  "externalon": true,
  "listener": "0.0.0.0",
  "SOAMname": "ns1.mesos",
  "SOARname": "root.ns1.mesos",
  "SOARefresh": 60,
  "SOARetry":   600,
  "SOAExpire":  86400,
  "SOAMinttl": 60,
  "IPSources": ["netinfo", "mesos", "host"]
}

• https://techpunch.co.uk/development/how-to-ship-logs-with-rsyslog-and-logstash
• https://www.elastic.co/guide/en/logstash/current/config-examples.html
• https://docs.mesosphere.com/1.8/administration/logging/elk/
• https://docs.mesosphere.com/1.8/administration/logging/filter-elk/
• http://unix.stackexchange.com/questions/103218/add-year-to-entries-generated-by-rsyslogd