docker-composeでfluentd + elasticsearch + kibana4　環境をつくる ref: http://qiita.com/cgetc/items/345e3c686910b30ba49f

docker-compose.yml

fluentd:
  build: ./fluentd
  links:
   - "elasticsearch"
  volumes:
   - /var/lib/docker/containers:/var/lib/docker/containers
   - /var/run:var/run
   - /var/log/docker:/var/log/docker

elasticsearch:
  image: elasticsearch
  expose:
    - 9200

kibana:
  image: library/kibana
  links:
   - "elasticsearch"
  ports:
   - "5601:5601"

Dockerfile

FROM kiyoto/fluentd:0.10.56-2.1.1
MAINTAINER [email protected]
RUN mkdir /etc/fluent
ADD fluent.conf /etc/fluent/
RUN ["apt-get", "update"]
RUN ["apt-get", "install", "--yes", "make", "libcurl4-gnutls-dev"]
RUN ["/usr/local/bin/gem", "install", "fluent-plugin-elasticsearch", "--no-rdoc", "--no-ri"]
RUN ["/usr/local/bin/gem", "install", "fluent-plugin-record-reformer", "--no-rdoc", "--no-ri"]
RUN ["/usr/local/bin/gem", "install", "fluent-plugin-docker-tag-resolver", "--no-rdoc", "--no-ri"]
ENTRYPOINT ["/usr/local/bin/fluentd", "-c", "/etc/fluent/fluent.conf"]

file1.txt

FROM kiyoto/fluentd:0.10.56-2.1.1
MAINTAINER [email protected]
RUN mkdir /etc/fluent
ADD fluent.conf /etc/fluent/
RUN ["apt-get", "update"]
RUN ["apt-get", "install", "--yes", "make", "libcurl4-gnutls-dev"]
RUN ["/usr/local/bin/gem", "install", "fluent-plugin-elasticsearch", "--no-rdoc", "--no-ri"]
RUN ["/usr/local/bin/gem", "install", "fluent-plugin-record-reformer", "--no-rdoc", "--no-ri"]
RUN ["/usr/local/bin/gem", "install", "fluent-plugin-docker-tag-resolver", "--no-rdoc", "--no-ri"]
ENTRYPOINT ["/usr/local/bin/fluentd", "-c", "/etc/fluent/fluent.conf"]

file3.txt

docker-compose up -d

fluent.conf

<source>
  type tail
  path /var/lib/docker/containers/*/*-json.log
  pos_file /var/log/fluentd-docker.pos
  time_format %Y-%m-%dT%H:%M:%S
  tag docker.log.*
  format json
</source>
<match docker.log.**>
  type docker_tag_resolver
</match>
<match docker.container.**>
  type record_reformer
  container_id ${tag_parts[4]}
  container_name ${tag_parts[3]}
  tag docker.all
</match>
<match docker.all>
  type elasticsearch
  log_level debug
  host elasticsearch
  port 9200
  include_tag_key true
  logstash_format true
  flush_interval 5s
</match>