docker-compose-syslog.yml

 version: '2'

 services:
   elastic:
     image: elasticsearch:2.4.0
     volumes:
       - /etc/timezone:/etc/timezone
     command: -Des.network.host=0.0.0.0 -Dhttp.cors.enabled=true -Dhttp.cors.allow-origin=*
     ports:
       - "9200:9200"
       - "9300:9300"


   logstash1:
     environment: 
       - counter_seed=1
       - counter_increment=3
     command: /opt/logstash/bin/logstash agent -f /config-dir/logstash.conf
     volumes:
       - ${PWD}/logstash-config/logstash.conf:/config-dir/logstash.conf:ro
       - /etc/timezone:/etc/timezone
     image: vivekjuneja/logstash:6
     ports:
       - "5001:5000"
       - "5001:5000/udp"
       - "12203:12201/udp"
     depends_on:
       - elastic


   logstash2:
     environment: 
       - counter_seed=2
       - counter_increment=3
     command: /opt/logstash/bin/logstash agent -f /config-dir/logstash.conf
     volumes:
       - ${PWD}/logstash-config/logstash.conf:/config-dir/logstash.conf:ro
       - /etc/timezone:/etc/timezone
     image: vivekjuneja/logstash:6
     ports:
       - "5002:5000"
       - "5002:5000/udp"
       - "12202:12201/udp"
     depends_on:
       - elastic


   kibana:
     environment: 
       - ELASTICSEARCH_URL=http://elastic:9200
     volumes:
       - /etc/timezone:/etc/timezone
     image: kibana:4.6.3
     ports:
       - "5601:5601"
     depends_on:
       - elastic


   filebeat:
     command: /bin/filebeat -e -v -d "*" -c /etc/filebeat/filebeat.yml
     volumes:
       - ${PWD}/filebeat/filebeat_directlogstash.yml:/etc/filebeat/filebeat.yml
       - /var/log/messages:/var/log/messages
       - /etc/timezone:/etc/timezone
     image: prima/filebeat:latest
     depends_on:
       - logstash1
       - logstash2