Would probably suggest a followup on using ES, Kibana and Filebeats from within a container... you can pass the docker socket to filebeats running in a container, and locally, since you're unlikely to cluster, having ES in the background with Kibana is probably easier to set/reset.