A docker-compose set up that has nginx -> ELK through RabbitMQ

03-rabbitmq-input.conf

input {
  rabbitmq {
    host => "rabbitmq"
    exchange => "logstash"
    exchange_type => "direct"
    key => "logstash"
    durable => true
  }
}

30-output.conf

output {
  elasticsearch {
    hosts => ["localhost"]
    manage_template => false
    index => "logstash-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }

  stdout {
    codec => rubydebug
  }
}

docker-compose.yml

version: '3'

services:
  rabbitmq:
    image: rabbitmq:alpine
    ports:
      - "15672:15672"

  nginx:
    image: nginx
    ports:
      - "8080:80"
    labels:
      - "filebeat.stdin=true"

  logstash:
    image: logstash:alpine
    command: "logstash -f /logstash.conf"
    volumes:
      - "./logstash.conf:/logstash.conf:ro"
    links:
      - rabbitmq

  elk:
    image: sebp/elk
    volumes:
      - "./03-rabbitmq-input.conf:/etc/logstash/conf.d/03-rabbitmq-input.conf:ro"
      - "./30-output.conf:/etc/logstash/conf.d/30-output.conf:ro"
    ports:
      - "5601:5601"
    links:
      - rabbitmq

  filebeat:
    image: willfarrell/filebeat:5-stdin
    environment:
      HOSTNAME: "filebeat"
      LOGSTASH_HOST: "logstash"
    volumes:
      - "/var/run/docker.sock:/tmp/docker.sock"
      - "./filebeat.yml:/etc/filebeat/filebeat.yml:ro"
    links:
      - logstash

filebeat.yml

filebeat.prospectors:
  - input_type: 'stdin'
    document_type: 'nginx-access'

output:
  console:
    pretty: true
  logstash:
    hosts: ["${LOGSTASH_HOST:logstash}:${LOGSTASH_PORT:5044}"]
    index: filebeat

logstash.conf

input {
  beats {
    port => 5044
  }
}

output {
  rabbitmq {
    host => "rabbitmq"
    exchange => "logstash"
    exchange_type => "direct"
    durable => true
    key => "logstash"
  }

  stdout {
    codec => rubydebug
  }
}