diff --git a/compose/elasticsearch/logstash/Dockerfile b/compose/elasticsearch/logstash/Dockerfile
new file mode 100644
index 0000000..ad7cb1c
--- /dev/null
+++ b/compose/elasticsearch/logstash/Dockerfile
@@ -0,0 +1,5 @@
+# Build from latest stable load
+FROM docker.elastic.co/logstash/logstash:5.2.2
+
+# Add logstash plugins 
+RUN logstash-plugin install logstash-output-opennms
diff --git a/compose/elasticsearch/logstash/config/logstash.conf b/compose/elasticsearch/logstash/config/logstash.conf
new file mode 100644
index 0000000..e822fe9
--- /dev/null
+++ b/compose/elasticsearch/logstash/config/logstash.conf
@@ -0,0 +1,110 @@
+## ------------------------------------------
+## Retrieve messages from Voltha alarm topic
+## ------------------------------------------
+
+input {
+  	kafka {
+		bootstrap_servers => "10.100.198.220:9092"
+		topics => ["voltha.alarms"]
+		tags => [ "alarm" ]
+		type => "voltha_alarms"
+  	}
+}
+
+## ------------------------------------------
+## The message field is a JSON block.
+## Break it down in multiple fields
+## for easy extraction
+## ------------------------------------------
+
+filter {
+    json{
+        source => "message"
+    }
+}
+
+## ------------------------------------------
+## Intercept alarm messages and manipulate 
+## the content prior to injection in OpenNMS 
+## ------------------------------------------
+
+filter {
+    if "alarm" in [tags] {
+        mutate {
+            add_field => { "[@metadata][alarm_id]" => "%{id}" }
+            add_field => { "[@metadata][resource_id]" => "%{resource_id}" }
+            add_field => { "[@metadata][description]" => "%{description}" }
+            add_field => { "[@metadata][type]" => "%{type}" }
+            add_field => { "[@metadata][category]" => "%{category}" }
+            add_field => { "[@metadata][state]" => "%{state}" }
+            add_field => { "[@metadata][raised_time]" => "%{raised_ts}" }
+            add_field => { "[@metadata][reported_time]" => "%{reported_ts}" }
+            add_field => { "[@metadata][changed_time]" => "%{changed_ts}" }
+            add_field => { "[@metadata][context]" => "%{context}" }
+            add_field => { "[@metadata][service]" => "voltha" }
+            add_field => { "[@metadata][interface]" => "localhost" }
+            add_tag   => "opennms"
+        }
+
+        if [state] == "RAISED" {
+            mutate {
+                add_field => { "[@metadata][uei]" => "uei.opennms.org/vendor/voltha/alarmRaised" }
+                add_field => { "[@metadata][severity]" => "%{severity}" }
+            }
+        } else if [state] == "CLEARED" {
+            mutate {
+                add_field => { "[@metadata][uei]" => "uei.opennms.org/vendor/voltha/alarmCleared" }
+                add_field => { "[@metadata][severity]" => "Normal" }
+            }
+        }
+    }
+}
+
+## ------------------------------------------
+## View incoming messages (for debugging)
+## ------------------------------------------
+
+output {
+    stdout {
+        codec  => rubydebug { metadata => true }
+    }
+}
+
+## ------------------------------------------
+## Forward alarm messages to OpenNMS
+## ------------------------------------------
+
+output {
+    if "opennms" in [tags] {
+        opennms {
+            opennms_server_hosts      => {
+                "10.100.198.220" => 5817
+            }
+
+            opennms_event_timezone    => "utc"
+            opennms_event_service     => "[@metadata][service]"
+            opennms_event_nodeid      => 0
+            opennms_event_interface   => "[@metadata][interface]"
+            opennms_event_uei         => "[@metadata][uei]"
+            opennms_event_severity    => "[@metadata][severity]"
+            opennms_event_description => "[@metadata][description]"
+            opennms_event_logmsg      => "logmsg"
+
+            opennms_event_parms => {
+                "AlarmId"       => "[@metadata][alarm_id]"
+                "ResourceId"    => "[@metadata][resource_id]"
+                "Description"   => "[@metadata][description]"
+                "Type"          => "[@metadata][type]"
+                "Category"      => "[@metadata][category]"
+                "State"         => "[@metadata][state]"
+                "Severity"      => "[@metadata][severity]"
+                "RaisedTime"    => "[@metadata][raised_time]"
+                "ReportedTime"  => "[@metadata][reported_time]"
+                "ChangedTime"   => "[@metadata][changed_time]"
+                "Context"       => "[@metadata][context]"
+            }
+
+            opennms_event_parms_order => [ "AlarmId", "ResourceId", "Description", "Type", "Category", "State", "Severity", "RaisedTime", "ReportedTime", "ChangedTime", "Context" ]
+        }
+    }
+}