How to forward application logs from Docker containers to ELK

Recent versions of Docker support transmitting logs in 'GELF' format to a network port. Logstash has a GELF input. You could run Logstash on every node and have all Docker instances on the node forward to it.

As a Logstash input: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-gelf.html

gelf {
}

For Docker output: https://docs.docker.com/engine/admin/logging/overview/#gelf

$ docker run -dit \
             --log-driver=gelf \
             --log-opt gelf-address=udp://127.0.0.1:12201 \
             alpine sh

(The gelf-address is from outside the containers perspective, not inside)