When the rsyslog is used for the first time we can see the following error is generated (which is also recorded into ES now):

invalid or yet-unknown config file command 'SystemLogSocketName' - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]

Digging a bit more in rsyslog config files on running Docker container I found we have these log:

bash-4.2# ls -l /etc/rsyslog.d/ 
total 12
-rw-r--r--. 1 root root  189 Jan 15 09:35 00-bitscout-tags.conf
-rw-r--r--. 1 root root 1634 Jan 15 09:35 01-bitscout-messaging.conf
-rw-r--r--. 1 root root   49 Jan 15 09:35 listen.conf

I wonder where the last config file comes from (is it part of original Docker image?). It has the following content:

cat /etc/rsyslog.d/listen.conf

$SystemLogSocketName /run/systemd/journal/syslog

This seems to be a legacy config directive for imuxsock module which I do not think are loading.

Either we should add imuxsock module, or fix/remove this legacy config directive.