balsamiq/docker-logstash repository overview

ES_CLUSTER_NAME     The name of the elasticsearch cluster, default is "elasticsearch".
										This is also the ec2 group name that is used for discovery.
ES_DISCOVERY        The type of discovery to use with elasticsearch, if not set will
                    use multicast. Setting to "ec2" will enable ec2 discovery using
                    ES_CLUSTER_NAME in ES_AWS_REGION.
ES_AWS_REGION       The aws region to be used for discovery, default is "us-east-1".
ES_AWS_ACCESS_KEY   The aws access key to be used for discovery.  Not required if
                    the instance profile has ec2 DescribeInstance permissions.
ES_AWS_SECRET_KEY   The aws secret key to be used for discovery.  Not required if
                    the instance profile has ec2 DescribeInstance permissions.
LOGSTASH_OPTS       Any additional logstash options such as --verbose to change the
										logging level to verbose.

docker build -t balsamiq/docker-logstash .

docker run -p 9200:9200 -p 9300:9300 -e ES_DISCOVERY=ec2 -v /var/log:/host/var/log balsamiq/docker-logstash

docker run -v /var/log:/host/var/log balsamiq/docker-logstash