Nice recipe. I don't find ELK particularly daunting to set up in docker containers, but it's nice to see a working config laid out like this. In our case we used haproxy and terminated ssl there also, but hginx works great in the same role. I like your use of syslog to ship to logstash. The first time I deployed this we used a custom python log handler to write to logstash directly, and then found we needed syslog to get events from the databases, proxies, etc. So we ended up with two paths, one for the stuff we wrote in python and one for everything else. Easier in the end to just use syslog.