logstash.conf

input {
  tcp {
    'port' => "9998"
    codec => json
  }

  udp {
    'port' => "9999"
    codec => json
  }

  stdin {
    type => "stdin-type"
  }

  file {
    type => "syslog"
    path => [ "/var/log/*.log", "/var/log/messages", "/var/log/syslog" ]
  }

  file {
    type => "logstash"
    path => [ "/var/log/logstash/logstash.log" ]
    start_position => "beginning"
  }
}

filter {
  if [type] == "docker" {
    json {
      source => "message"
    }
    mutate {
      rename => [ "log", "message" ]
    }
    date {
      match => [ "time", "ISO8601" ]
    }
  }
}

output {
  stdout {
    codec => rubydebug
  }

  elasticsearch {
    embedded => ES_EMBEDDED
    host => "ES_HOST"
    port => "ES_PORT"
    protocol => "http"
  }
}