Don't need the embedded elasticsearch output in logstash because we just need it to act as a node which is the default setting.  Expose ports 9200 and 9300 in Dockerfile.  Use the _ec2_ setting (use private ec2 ip address) for the network.publish.host in elasticsearch.yml so that the logstash elasticsearch node is reachable by other nodes.