diff --git a/docker/logstash/Dockerfile.j2 b/docker/logstash/Dockerfile.j2
index 2bb2684672..175537fbdd 100644
--- a/docker/logstash/Dockerfile.j2
+++ b/docker/logstash/Dockerfile.j2
@@ -9,7 +9,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {% if base_distro in ['centos', 'oraclelinux', 'rhel'] %}
     {% set logstash_packages = [
-        'logstash',
         'java-1.8.0-openjdk-headless'
     ] %}
 
@@ -17,8 +16,8 @@ ENV JAVA_HOME /usr/lib/jvm/jre-1.8.0-openjdk/
 
 {% elif base_distro in ['debian', 'ubuntu'] %}
     {% set logstash_packages = [
-        'logstash',
-        'openjdk-8-jre-headless'
+        'openjdk-8-jre-headless',
+        'logrotate'
     ] %}
 
 {% if base_arch == 'x86_64' %}
@@ -36,6 +35,31 @@ ENV JAVA_HOME /usr/lib/jvm/java-8-openjdk-${java_arch}/
 {{ macros.install_packages(logstash_packages | customizable("packages")) }}
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
+# FIXME(dszumski): Logstash was added to Kolla for Monasca. Monasca is
+# currently tied to an old messaging version in Kafka (0.9) and doesn't
+# work with Logstash 5.x or above. When Monasca is updated to use a more
+# recent messaging version this patch should be reverted and the Monasca
+# Logstash configuration files upgraded to use the new format.
+{% if base_distro in ['centos', 'oraclelinux', 'rhel'] %}
+
+ENV logstash_rpm_url=https://download.elastic.co/logstash/logstash/packages/centos/logstash-2.4.1.noarch.rpm
+ENV logstash_rpm_sha1sum=68c5e78c3d941f06f77d638c0756b6aea715bec5
+RUN curl -sSL -o /tmp/logstash.rpm ${logstash_rpm_url} \
+    && echo "${logstash_rpm_sha1sum} /tmp/logstash.rpm" | sha1sum -c \
+    && yum -y install /tmp/logstash.rpm \
+    && rm -f /tmp/logstash.rpm
+
+{% elif base_distro in ['debian', 'ubuntu'] %}
+
+ENV logstash_deb_url=https://download.elastic.co/logstash/logstash/packages/debian/logstash-2.4.1_all.deb
+ENV logstash_deb_sha1sum=7ba3b174a3ef48a7d0945d9b5c7f12c5005abb47
+RUN curl -sSL -o /tmp/logstash.deb ${logstash_deb_url} \
+    && echo "${logstash_deb_sha1sum} /tmp/logstash.deb" | sha1sum -c \
+    && apt install /tmp/logstash.deb \
+    && rm -f /tmp/logstash.deb
+
+{% endif %}
+
 RUN chmod 755 /usr/local/bin/kolla_extend_start
 
 {% block logstash_footer %}{% endblock %}