Running Logstash on Dockeredit

Docker images for Logstash are available from the Elastic Docker registry. The base image is centos:7.

A list of all published Docker images and tags can be found at The source code can be found on GitHub.

Image typesedit

The images are available in two different configurations or "flavors". The x-pack flavor, which is the default, ships with X-Pack features pre-installed. The oss flavor does not include X-Pack, and contains only open source Logstash.

X-Pack is pre-installed in the default image. With X-Pack installed, Logstash expects to connect to an Elasticsearch cluster that is also running X-Pack, in order to publish data for the Monitoring component.

Pulling the imageedit

Obtaining Logstash for Docker is as simple as issuing a docker pull command against the Elastic Docker registry.

Docker images can be retrieved with the following commands:

docker pull
docker pull