diff --git a/containers/elk/logstash-forwarder/Dockerfile b/containers/elk/logstash-forwarder/Dockerfile
new file mode 100644
index 0000000..05979c9
--- /dev/null
+++ b/containers/elk/logstash-forwarder/Dockerfile
@@ -0,0 +1,27 @@
+FROM ubuntu:14.04.2
+
+ENV LOGSTASH_HOST 66.228.36.77
+
+RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y --force-yes \
+    git \
+    golang \
+    supervisor
+
+RUN git clone git://github.com/elasticsearch/logstash-forwarder.git /tmp/logstash-forwarder
+RUN cd /tmp/logstash-forwarder && git checkout v0.4.0 && go build
+
+RUN mkdir /opt/logstash-forwarder && cp /tmp/logstash-forwarder/logstash-forwarder /opt/logstash-forwarder/logstash-forwarder
+
+ADD conf/config.json /opt/logstash-forwarder/config.json
+ADD conf/supervisord.conf /etc/supervisor/conf.d/logstash-forwarder.conf
+ADD run_logstash-forwarder /opt/logstash-forwarder/run_logstash-forwarder
+
+RUN chmod +x /opt/logstash-forwarder/run_logstash-forwarder
+
+RUN rm -rf /tmp/*
+
+VOLUME ["/opt/certs", "/var/log/"]
+
+CMD /opt/logstash-forwarder/run_logstash-forwarder
+
+
diff --git a/containers/elk/logstash-forwarder/Makefile b/containers/elk/logstash-forwarder/Makefile
new file mode 100644
index 0000000..cc52790
--- /dev/null
+++ b/containers/elk/logstash-forwarder/Makefile
@@ -0,0 +1,11 @@
+.PHONY: build
+build: ; docker build --rm -t logstash-forwarder .
+
+.PHONY: run
+run: ; docker run --rm -v `pwd`/../logstash/certs:/opt/certs -v /var/log/:/var/log --name logstash-forwarder_server -i -t logstash-forwarder
+
+.PHONY: stop
+stop: ; docker stop logstash-forwarder_server 
+
+.PHONY: rmcontainer
+rmcontainer: ; docker rm logstash-forwarder_server 
diff --git a/containers/elk/logstash-forwarder/conf/config.json b/containers/elk/logstash-forwarder/conf/config.json
new file mode 100644
index 0000000..71a9975
--- /dev/null
+++ b/containers/elk/logstash-forwarder/conf/config.json
@@ -0,0 +1,15 @@
+{
+  "network": {
+    "servers": [ "logstash:5043" ],
+    "ssl certificate": "/opt/certs/logstash-forwarder.crt",
+    "ssl key": "/opt/certs/logstash-forwarder.key",
+    "ssl ca": "/opt/certs/logstash-forwarder.crt",
+    "timeout": 15
+  },
+  "files": [
+    {
+      "paths": [ "/var/log/message", "/var/log/syslog" ],
+      "fields": { "type": "stdin" }
+    }
+  ]
+}
diff --git a/containers/elk/logstash-forwarder/conf/supervisord.conf b/containers/elk/logstash-forwarder/conf/supervisord.conf
new file mode 100644
index 0000000..c91b37c
--- /dev/null
+++ b/containers/elk/logstash-forwarder/conf/supervisord.conf
@@ -0,0 +1,9 @@
+[supervisord]
+nodaemon=true
+
+[program:logstash-forwarder]
+command=/opt/logstash-forwarder/logstash-forwarder -config /opt/logstash-forwarder/config.json 
+autorestart=true
+stderr_logfile=/var/log/logstash.err.log
+stdout_logfile=/var/log/logstash.out.log
+
diff --git a/containers/elk/logstash-forwarder/extfile.cnf b/containers/elk/logstash-forwarder/extfile.cnf
new file mode 100644
index 0000000..337a5f4
--- /dev/null
+++ b/containers/elk/logstash-forwarder/extfile.cnf
@@ -0,0 +1 @@
+subjectAltName = IP:66.228.36.77
diff --git a/containers/elk/logstash-forwarder/run_logstash-forwarder b/containers/elk/logstash-forwarder/run_logstash-forwarder
new file mode 100644
index 0000000..e97edc4
--- /dev/null
+++ b/containers/elk/logstash-forwarder/run_logstash-forwarder
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+sed -i "s/logstash:5043/${LOGSTASH_HOST}:5043/g" /opt/logstash-forwarder/config.json
+
+/usr/bin/supervisord -c /etc/supervisor/conf.d/logstash-forwarder.conf