i’m not really familiar with running logstash in docker, but based on the documentation , logstash in docker will look for pipeline and config under /usr/share/logstash/pipeline/ and you will need to either overwrite logstash.conf in that directory or overwrite the entire default pipeline directory altogether. your config above uses /usr/share/logstash/config
nothing in your config indicates that you’re sending output to stdout, yet you’re seeing documents in stdout. my guess is that logstash is picking up wrong config due to that behavior mentioned in documentation.