input { udp { port => 5000 codec => json } } filter { if [docker][image] =~ /logstash/ { drop { } } } output { elasticsearch { hosts => ["elasticsearch:9200"] } }