Fluentd+Elasticsearch on Docker

docker-compose.yml

version: '2.2'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.4.0
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - es_data:/usr/share/elasticsearch/data
    networks:
      - es_net

  kibana:
    image: docker.elastic.co/kibana/kibana:7.4.0
    container_name: kibana
    ports:
      - 5601:5601
    depends_on:
      - fluentd
      - elasticsearch
    logging:
      driver: fluentd
      options:
        fluentd-address: localhost:24224
        tag: docker.{{.Name}}
    networks:
      - es_net

  fluentd:
    build: fluentd
    container_name: fluentd
    ports: # syslog(514),fluentd(24224)を解放
      - 514:5140
      - 514:5140/udp
      - 24224:24224
      - 24224:24224/udp
    depends_on:
      - elasticsearch
    volumes:
      - ./log:/fluentd/log
      - ./conf/fluent.conf:/fluentd/etc/fluent.conf
    networks:
      - es_net

volumes:
  es_data:
    driver: local

networks:
  es_net:

Dockerfile

FROM fluentd:latest

USER root
RUN gem install fluent-plugin-elasticsearch

fluent.conf

<source>
  @type  forward
  @id    input1
  @label @mainstream
  port  24224
</source>

<source>
  @type  syslog
  @id    input2
  @label @mainstream
  port 5140
  bind 0.0.0.0
  tag syslog
</source>

<filter **>
  @type stdout
</filter>

<label @mainstream>
  <match docker.**>
    @type copy
    <store>
        @type file
        @id   output_docker1
        path         /fluentd/log/docker.*.log
        symlink_path /fluentd/log/docker.log
        append       true
        time_slice_format %Y%m%d
        time_slice_wait   1m
        time_format       %Y%m%dT%H%M%S%z
    </store>
    <store>
      @type elasticsearch
      host elasticsearch
      port 9200
      logstash_format true
    </store>
  </match>
  <match syslog.**>
    @type copy
    <store>
        @type file
        @id   output_syslog1
        path         /fluentd/log/syslog.*.log
        symlink_path /fluentd/log/syslog.log
        append       true
        time_slice_format %Y%m%d
        time_slice_wait   1m
        time_format       %Y%m%dT%H%M%S%z
    </store>
    <store>
      @type elasticsearch
      host elasticsearch
      port 9200
      logstash_format true
    </store>
  </match>
  <match **>
    @type file
    @id   output1
    path         /fluentd/log/data.*.log
    symlink_path /fluentd/log/data.log
    append       true
    time_slice_format %Y%m%d
    time_slice_wait   10m
    time_format       %Y%m%dT%H%M%S%z
  </match>
</label>