https://github.com/uken/fluent-plugin-elasticsearch/issues/227

docker-compose.yml

version: "2"

services:
  fluentd:
    image: ps-fluentd
    ports:
      - "24224:24224"
    networks:
      - lognet
  elasticsearch:
    image: elasticsearch:2.3
    ports:
      - "9200:9200"
      - "9300:9300"
    networks:
      - lognet
  kibana:
    image: kibana:4.5
    restart: always
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_URL=http://elasticsearch:9200
    networks:
      - lognet
  nginx:
    image: nginx
    depends_on:
      - fluentd
    ports:
      - "80:80"
    logging:
      driver: fluentd
    networks:
      - lognet
networks:
  lognet:
    driver: bridge

Dockerfile

FROM fluent/fluentd:v0.12.29
RUN gem install fluent-plugin-elasticsearch -v 1.9.0 && \
    gem install fluent-plugin-record-modifier -v 0.5.0
EXPOSE 24224
COPY fluent.conf /etc/fluent.conf
CMD fluentd -c /etc/fluent.conf -p /fluentd/plugins

fluentd.conf

<source>
  @type forward
</source>

<filter *.docker.** docker.**>
  @type record_modifier
  <record>
    @timestamp ${Time.now.strftime("%Y-%m-%dT%H:%M:%S.%L%z")}
  </record>
</filter>

<match **.docker.**>
  type elasticsearch
  host elasticsearch
  port 9200
  flush_interval 10s
</match>

mapping.json

{
    "mappings": {
        "fluentd": {
            "properties": {
                "log": {
                    "type": "object"
                }
            }
        }
    }
}