diff --git a/Dockerfile b/Dockerfile
index 37a24ecd..77346926 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -39,7 +39,9 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update -q --fix-missing && \
     && \
   curl -sk http://neuro.debian.net/lists/trusty.de-m.libre > /etc/apt/sources.list.d/neurodebian.sources.list && \
   apt-key adv --recv-keys --keyserver hkp://pgp.mit.edu:80 0xA5D32F012649A5A9 && \
-  apt-get update -q --fix-missing && apt-get -y upgrade fail2ban && \
+  curl https://packages.elasticsearch.org/GPG-KEY-elasticsearch | apt-key add - && \
+  echo "deb http://packages.elastic.co/beats/apt stable main" | tee -a /etc/apt/sources.list.d/beats.list && \
+  apt-get update -q --fix-missing && apt-get -y upgrade fail2ban filebeat && \
   apt-get autoclean && rm -rf /var/lib/apt/lists/* && \
   rm -rf /usr/share/locale/* && rm -rf /usr/share/man/* && rm -rf /usr/share/doc/*
 
@@ -112,3 +114,8 @@ RUN chmod +x /usr/local/bin/*
 EXPOSE 25 587 143 993 110 995 4190
 
 CMD /usr/local/bin/start-mailserver.sh
+
+
+ADD target/filebeat.yml.tmpl /etc/filebeat/filebeat.yml.tmpl
+
+
diff --git a/target/filebeat.yml.tmpl b/target/filebeat.yml.tmpl
new file mode 100644
index 00000000..d2d84ed4
--- /dev/null
+++ b/target/filebeat.yml.tmpl
@@ -0,0 +1,13 @@
+output:
+  logstash:
+    enabled: true
+    hosts:
+      - $ELK_HOST:$ELK_PORT
+
+filebeat:
+  prospectors:
+    -
+      paths:
+        - /var/log/mail/mail.log
+      document_type: syslog
+
diff --git a/target/start-mailserver.sh b/target/start-mailserver.sh
index afd4213b..5d3aeae0 100644
--- a/target/start-mailserver.sh
+++ b/target/start-mailserver.sh
@@ -355,17 +355,21 @@ if [ "$ONE_DIR" = 1 -a -d $statedir ]; then
   done
 fi
 if [ "$ENABLE_ELK_FORWARDER" = 1 ]; then
-ELK_PORT=${ELK_PORT:="10514"}
+ELK_PORT=${ELK_PORT:="5044"}
 ELK_HOST=${ELK_HOST:="elk"}
 echo "Enabling log forwarding to ELK ($ELK_HOST:$ELK_PORT)"
-echo " *.* @$ELK_HOST:$ELK_PORT " > /etc/rsyslog.d/60-elk.conf
-else 
-  rm -f /etc/rsyslog.d/60-elk.conf
+cat /etc/filebeat/filebeat.yml.tmpl \
+	| sed "s@\$ELK_HOST@$ELK_HOST@g" \
+	| sed "s@\$ELK_PORT@$ELK_PORT@g" \
+	 > /etc/filebeat/filebeat.yml
 fi
 
 echo "Starting daemons"
 cron
 /etc/init.d/rsyslog start
+if [ "$ENABLE_ELK_FORWARDER" = 1 ]; then
+/etc/init.d/filebeat start
+fi
 
 # Enable Managesieve service by setting the symlink
 # to the configuration file Dovecot will actually find