diff --git a/ansible/roles/monitoring/docker-stack.yml.j2 b/ansible/roles/monitoring/docker-stack.yml.j2
index bf8f9db..7d15a4d 100644
--- a/ansible/roles/monitoring/docker-stack.yml.j2
+++ b/ansible/roles/monitoring/docker-stack.yml.j2
@@ -9,6 +9,9 @@ configs:
   esdatasource:
     external: true
     name: "{{ esdatasource.config_name }}"
+  fluentconf:
+    external: true
+    name: "{{ fluentconf.config_name }}"
 
 volumes:
   escerts:
@@ -96,3 +99,11 @@ services:
     configs:
       - source: esdatasource
         target: /etc/grafana/provisioning/datasources/elasticsearch.yaml
+
+  fluentd:
+    image: git.kun.is/pim/fluentd:1.0.1
+    ports:
+      - 24224:24224
+    configs:
+      - source: fluentconf
+        target: /fluentd/etc/fluent.conf
diff --git a/ansible/roles/monitoring/elasticsearch.yml b/ansible/roles/monitoring/elasticsearch.yml.j2
similarity index 94%
rename from ansible/roles/monitoring/elasticsearch.yml
rename to ansible/roles/monitoring/elasticsearch.yml.j2
index a898f3e..7d710c7 100644
--- a/ansible/roles/monitoring/elasticsearch.yml
+++ b/ansible/roles/monitoring/elasticsearch.yml.j2
@@ -1,3 +1,4 @@
+# vi: ft=yaml
 apiVersion: 1
 
 datasources:
diff --git a/ansible/roles/monitoring/fluent.conf.j2 b/ansible/roles/monitoring/fluent.conf.j2
new file mode 100644
index 0000000..84895d9
--- /dev/null
+++ b/ansible/roles/monitoring/fluent.conf.j2
@@ -0,0 +1,18 @@
+# vi: ft=yaml
+# Receive events from 24224/tcp
+# This is used by log forwarding and the fluent-cat command
+<source>
+  @type forward
+  port 24224
+</source>
+
+<match cool.testje>
+  @type elasticsearch
+  host maestro.dmz
+  port {{ elasticsearch_port }}
+  include_timestamp true
+</match>
+
+<system>
+  log_level info
+</system>
diff --git a/ansible/roles/monitoring/tasks/main.yml b/ansible/roles/monitoring/tasks/main.yml
index c5958c3..191f846 100644
--- a/ansible/roles/monitoring/tasks/main.yml
+++ b/ansible/roles/monitoring/tasks/main.yml
@@ -1,7 +1,15 @@
+- name: Create fluentd config
+  docker_config:
+    name: fluentconf
+    data: "{{ lookup('template', '{{ role_path }}/fluent.conf.j2') }}"
+    use_ssh_client: true
+    rolling_versions: true
+  register: fluentconf
+
 - name: Create elasticsearch data source config
   docker_config:
     name: esdatasource
-    data: "{{ lookup('template', '{{ role_path }}/elasticsearch.yml') }}"
+    data: "{{ lookup('template', '{{ role_path }}/elasticsearch.yml.j2') }}"
     use_ssh_client: true
     rolling_versions: true
   register: esdatasource