diff --git a/docker-compose.yml b/docker-compose.yml
index 83db10b4..8f0a8476 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,83 +1,103 @@
 version: '2.1'
 services:
   elasticsearch:
     container_name: elasticsearch
     environment:
       - cluster.routing.allocation.disk.threshold_enabled=false
       - discovery.type=single-node
     hostname: elasticsearch
     image: elasticsearch:7.3.2
     network_mode: host
     volumes:
       - /data/elasticsearch/kolab/elasticsearch/:/usr/share/elasticsearch/data/
   kibana:
     container_name: kibana
     extra_hosts:
       - "elasticsearch:127.0.0.1"
     hostname: kibana
     image: kibana:7.3.2
     network_mode: host
   kolab:
     build:
       context: ./docker/kolab/
     container_name: kolab
     depends_on:
       mariadb:
         condition: service_healthy
     extra_hosts:
       - "kolab.mgmt.com:127.0.0.1"
     healthcheck:
       interval: 10s
       test: test -f /tmp/kolab-init.done
       timeout: 5s
       retries: 30
     hostname: kolab.mgmt.com
     network_mode: host
     tmpfs:
       - /run
       - /tmp
       - /var/run
       - /var/tmp
     tty: true
     volumes:
       - ./docker/certs/ca.cert:/etc/pki/tls/certs/ca.cert:ro
       - ./docker/certs/ca.cert:/etc/pki/ca-trust/source/anchors/ca.cert:ro
       - ./docker/certs/kolab.hosted.com.cert:/etc/pki/tls/certs/kolab.hosted.com.cert
       - ./docker/certs/kolab.hosted.com.key:/etc/pki/tls/certs/kolab.hosted.com.key
       - ./docker/certs/kolab.mgmt.com.cert:/etc/pki/tls/certs/kolab.mgmt.com.cert
       - ./docker/certs/kolab.mgmt.com.key:/etc/pki/tls/certs/kolab.mgmt.com.key
       - ./docker/kolab/utils:/root/utils:ro
       - /sys/fs/cgroup:/sys/fs/cgroup:ro
+  logstash:
+    container_name: logstash-kolab
+    environment:
+      - config.reload.automatic=true
+      #- pipeline.workers=1
+      #- pipeline.batch.size=1
+      - xpack.monitoring.enabled=true
+    extra_hosts:
+      - "elasticsearch:127.0.0.1"
+      - "redis:127.0.0.1"
+    hostname: logstash
+    image: logstash:7.3.2
+    network_mode: host
+    volumes:
+      - ./docker/logstash/_grokparsefailures/:/usr/share/logstash/_grokparsefailures/
+      - ./docker/logstash/patterns/:/usr/share/logstash/patterns/:ro
+      - ./docker/logstash/pipeline/:/usr/share/logstash/pipeline/:ro
+      - ./docker/logstash/templates/:/usr/share/logstash/templates/:ro
+      #- ./docker/logstash/data/:/data/logs/:ro
+      - /data/logs/:/data/logs/:ro
   mariadb:
     container_name: mariadb
     environment:
       MYSQL_ROOT_PASSWORD: Welcome2KolabSystems
     healthcheck:
       interval: 10s
       test: test -e /var/run/mysqld/mysqld.sock
       timeout: 5s
       retries: 30
     image: mariadb
     network_mode: host
   redis:
     container_name: redis-kolab
     image: redis
     network_mode: host
   worker:
     build:
       context: ./docker/worker/
     container_name: worker
     depends_on:
       kolab:
         condition: service_healthy
     hostname: worker
     network_mode: host
     tmpfs:
       - /run
       - /tmp
       - /var/run
       - /var/tmp
     tty: true
     volumes:
       - ./src:/home/worker/src.orig:ro
       - /sys/fs/cgroup:/sys/fs/cgroup:ro