Cleaned up YAML from the blog post: Log Searching and Analysis with Tutum and an ELK - http://blog.tutum.co/2015/05/26/log-searching-and-analysis-with-tutum-and-an-elk-2/

tutum.yml

elasticsearch-data:
  image: 'alpine'
  command: '/bin/true'
  volumes:
  - '/data/elasticsearch:/usr/share/elasticsearch/data'

elasticsearch:
  image: 'elasticsearch:1.5'
  ports:
  - '9200:9200'
  volumes_from:
  - 'elasticsearch-data'

logstash:
  image: 'logstash'
  command: 'logstash -e ''input { syslog { port => 12345 type => "docker" } } output { elasticsearch_http { host => "elasticsearch" } }'''
  expose:
  - '12345/tcp'
  - '12345/udp'
  links:
  - elasticsearch

logspout:
  image: 'gliderlabs/logspout'
  entrypoint: '/bin/sh'
  command: '-c ''/bin/logspout syslog://$LOGSTASH_PORT_12345_UDP_ADDR:12345'''
  deployment_strategy: every_node
  volumes:
  - '/var/run/docker.sock:/tmp/docker.sock'
  links:
  - logstash

kibana:
  image: marcbachmann/kibana4
  environment:
  - ELASTICSEARCH=http://elasticsearch:9200
  ports:
  - '5601:5601'
  links:
  - elasticsearch