diff --git a/.gitignore b/.gitignore
index 84b87b711..d0a390f5b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,4 +40,5 @@ docs_source/resources.mk
 docs_source/public
 
 # examples
-terraform.tfstate*
\ No newline at end of file
+terraform.tfstate*
+.vagrant
\ No newline at end of file
diff --git a/examples/elk/README.md b/examples/elk/README.md
new file mode 100644
index 000000000..083838954
--- /dev/null
+++ b/examples/elk/README.md
@@ -0,0 +1,63 @@
+# converge-elk
+
+The [ELK stack](https://www.elastic.co/webinars/introduction-elk-stack) is
+traditionally composed of
+[Elasticsearch](https://www.elastic.co/products/elasticsearch),
+[Logstash](https://www.elastic.co/products/logstash), and
+[Kibana](https://www.elastic.co/products/kibana) and is a great solution for
+collecting, searching, and visualizing logs. In this example, we are configuring
+a docker-based ELK stack. However, since this is a single-node demonstration, we
+are using [Filebeat](https://www.elastic.co/products/beats/filebeat) instead of
+Logstash for the log collection component.
+
+## Usage
+
+### Vagrant
+
+Just run `vagrant up`!
+
+After Vagrant provisioning completes, you should have a working Kibana instance
+backed by Elasticsearch. Filebeat is installed on the Vagrant host and is
+configured to send logs to Elasticsearch. You should be able to access the
+Kibana web interface at [http://localhost:5601](http://localhost:5601).
+
+### Terraform (AWS)
+
+You must have a version of the
+[Converge Terraform provisioner](https://github.com/ChrisAubuchon/terraform-provisioner-converge)
+built and configured as a plugin for Terraform:
+
+```shell
+$ cat ~/.terraformrc
+provisioners {
+  converge = "/path/to/terraform-provisioner-converge"
+}
+```
+
+You must have also set valid
+[AWS credentials](https://www.terraform.io/docs/providers/aws/index.html)
+(`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) in your environment. Then you
+can run:
+
+```
+terraform apply
+```
+
+After provisioning completes, you should be able to retrieve the url for the
+Kibana interface by running:
+
+```shell
+echo "http://$(terraform output ip):5601/"
+```
+
+## Graphs
+
+This is the visualization of the graph that Converge applies to the system.
+
+![elk graph](./graphs/elk.png)
+
+## Warning
+
+When deploying via Terraform, Kibana will be publicly accessible on port 5601
+without authentication. You can adjust the security group in `main.tf` to change
+this behavior.
diff --git a/examples/elk/Vagrantfile b/examples/elk/Vagrantfile
new file mode 100644
index 000000000..bbd310f54
--- /dev/null
+++ b/examples/elk/Vagrantfile
@@ -0,0 +1,20 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+converge_version = "0.2.0-beta1"
+release_url = "https://github.com/asteris-llc/converge/releases/download/#{converge_version}/converge_#{converge_version}_linux_amd64.tar.gz"
+
+converge_script = <<SCRIPT
+cd /tmp
+curl -SL #{release_url} -o converge.tar.gz
+tar -xzvf converge.tar.gz
+mv converge /usr/local/bin
+sudo /usr/local/bin/converge apply --local --log-level=info /vagrant/converge/elk.hcl
+SCRIPT
+
+Vagrant.configure("2") do |config|
+  config.vm.box = "centos/7"
+  config.vm.synced_folder ".", "/vagrant", type: "rsync", rsync__exclude: ".git/"
+  config.vm.network "forwarded_port", guest: 5601, host: 5601
+  config.vm.provision "shell", inline: converge_script
+end
diff --git a/examples/elk/converge/docker.hcl b/examples/elk/converge/docker.hcl
new file mode 100644
index 000000000..ca518ff74
--- /dev/null
+++ b/examples/elk/converge/docker.hcl
@@ -0,0 +1,52 @@
+param "docker-package" {
+  default = "docker-engine"
+}
+
+param "docker-service" {
+  default = "docker"
+}
+
+param "docker-group" {
+  default = "docker"
+}
+
+param "user-name" {
+  default = "vagrant"
+}
+
+file.content "docker-repo" {
+  destination = "/etc/yum.repos.d/docker.repo"
+
+  content = <<EOF
+[dockerrepo]
+name=Docker Repository
+baseurl=https://yum.dockerproject.org/repo/main/centos/7/
+enabled=1
+gpgcheck=1
+gpgkey=https://yum.dockerproject.org/gpg
+EOF
+}
+
+task "docker-install" {
+  check   = "yum list installed {{param `docker-package`}}"
+  apply   = "yum makecache; yum install -y {{param `docker-package`}}"
+  depends = ["file.content.docker-repo"]
+}
+
+task "docker-user-group" {
+  check   = "groups {{param `user-name`}} | grep -i {{param `docker-group`}}"
+  apply   = "usermod -aG {{param `docker-group`}} {{param `user-name`}}"
+  depends = ["task.docker-install"]
+}
+
+task "docker-enable" {
+  check   = "systemctl is-enabled {{param `docker-service`}}"
+  apply   = "systemctl enable {{param `docker-service`}}"
+  depends = ["task.docker-user-group"]
+}
+
+task "docker-start" {
+  check   = "systemctl is-active {{param `docker-service`}}"
+  apply   = "systemctl start {{param `docker-service`}}"
+  depends = ["task.docker-enable"]
+}
diff --git a/examples/elk/converge/elk.hcl b/examples/elk/converge/elk.hcl
new file mode 100644
index 000000000..23b011a34
--- /dev/null
+++ b/examples/elk/converge/elk.hcl
@@ -0,0 +1,114 @@
+param "user-name" {
+  default = "vagrant"
+}
+
+module "packages.hcl" "packages" {}
+
+module "docker.hcl" "docker" {
+  params = {
+    user-name = "{{param `user-name`}}"
+  }
+  depends = ["module.packages"]
+}
+
+param "elasticsearch-data-directory" {
+  default = "/data/elasticsearch"
+}
+
+param "filebeat-service" {
+  default = "filebeat"
+}
+
+task "filebeat-install" {
+  check   = "yum list installed filebeat"
+  apply   = "rpm -ivh https://download.elastic.co/beats/filebeat/filebeat-1.3.0-x86_64.rpm"
+  depends = ["module.docker"]
+}
+
+file.content "filebeat-yml" {
+  destination = "/etc/filebeat/filebeat.yml"
+
+  content = <<EOF
+filebeat:
+  prospectors:
+    - paths:
+        - /var/log/*.log
+        - /var/log/messages
+      input_type: log
+  registry_file: /var/lib/filebeat/registry
+output:
+  elasticsearch:
+    hosts: ["localhost:9200"]
+EOF
+
+  depends = ["task.filebeat-install"]
+}
+
+task "filebeat-enable" {
+  check   = "systemctl is-enabled {{param `filebeat-service`}}"
+  apply   = "systemctl enable {{param `filebeat-service`}}"
+  depends = ["file.content.filebeat-yml"]
+}
+
+task.query "elasticsearch-wait" {
+  query = <<EOF
+MAX_SECONDS=60
+while /bin/true
+do
+    status=$(curl -s 'http://localhost:9200/_cluster/health' 2>/dev/null | jq -r .status)
+    if [ "$status" == "yellow" ] || [ "$status" == "green" ] ; then
+        exit 0
+    fi
+    [[ "$SECONDS" -ge "$MAX_SECONDS" ]] && exit 1
+done
+EOF
+
+  depends = ["docker.container.elasticsearch-container"]
+}
+
+task "filebeat-elasticsearch-template" {
+  check   = "[[  \"$(curl 'http://localhost:9200/_template/filebeat' 2>/dev/null)\" != \"{}\" ]] || exit 1"
+  apply   = "curl -XPUT 'http://localhost:9200/_template/filebeat' -d@/etc/filebeat/filebeat.template.json 2>/dev/null"
+  depends = ["task.filebeat-enable", "docker.container.elasticsearch-container", "task.query.elasticsearch-wait"]
+}
+
+task "filebeat-start" {
+  check   = "systemctl is-active {{param `filebeat-service`}}"
+  apply   = "systemctl start {{param `filebeat-service`}}"
+  depends = ["task.filebeat-enable", "docker.container.elasticsearch-container"]
+}
+
+file.directory "elasticsearch-data-directory" {
+  destination = "{{param `elasticsearch-data-directory`}}"
+  create_all = true
+}
+
+docker.image "elasticsearch-image" {
+  name    = "elasticsearch"
+  tag     = "2.4.0"
+  depends = ["module.docker"]
+}
+
+docker.container "elasticsearch-container" {
+  name    = "elasticsearch"
+  image   = "{{lookup `docker.image.elasticsearch-image.name`}}:{{lookup `docker.image.elasticsearch-image.tag`}}"
+  command = ["elasticsearch", "-Des.insecure.allow.root=true"]
+  ports   = ["127.0.0.1:9200:9200"]
+  volumes = ["{{param `elasticsearch-data-directory`}}:/usr/share/elasticsearch/data"]
+  force   = "true"
+  depends = ["file.directory.elasticsearch-data-directory"]
+}
+
+docker.image "kibana-image" {
+  name    = "kibana"
+  tag     = "4.6.0"
+  depends = ["module.docker"]
+}
+
+docker.container "kibana-container" {
+  name  = "kibana"
+  image = "{{lookup `docker.image.kibana-image.name`}}:{{lookup `docker.image.kibana-image.tag`}}"
+  ports = ["5601:5601"]
+  links = ["{{lookup `docker.container.elasticsearch-container.name`}}:elasticsearch"]
+  force = "true"
+}
diff --git a/examples/elk/converge/packages.hcl b/examples/elk/converge/packages.hcl
new file mode 100644
index 000000000..f8eb4c4f4
--- /dev/null
+++ b/examples/elk/converge/packages.hcl
@@ -0,0 +1,10 @@
+task "epel-install" {
+  check = "test -f /etc/yum.repos.d/epel.repo"
+  apply = "yum makecache; yum install -y epel-release"
+}
+
+task "jq-install" {
+  check   = "yum list installed jq"
+  apply   = "yum makecache; yum install -y jq"
+  depends = ["task.epel-install"]
+}
diff --git a/examples/elk/graphs/elk.png b/examples/elk/graphs/elk.png
new file mode 100644
index 000000000..cf054507d
Binary files /dev/null and b/examples/elk/graphs/elk.png differ
diff --git a/examples/elk/main.tf b/examples/elk/main.tf
new file mode 100644
index 000000000..a5e16043b
--- /dev/null
+++ b/examples/elk/main.tf
@@ -0,0 +1,139 @@
+variable "name" {
+  default = "elk-test"
+}
+
+variable "region" {
+  default = "us-east-1"
+}
+
+variable "public_key_path" {
+  default = "~/.ssh/id_rsa.pub"
+}
+
+variable "amis" {
+  # centos 7
+  default = {
+    ap-south-1     = "ami-95cda6fa"
+    ap-southeast-1 = "ami-f068a193"
+    ap-southeast-2 = "ami-fedafc9d"
+    ap-northeast-1 = "ami-eec1c380"
+    ap-northeast-2 = "ami-c74789a9"
+    eu-central-1   = "ami-9bf712f4"
+    eu-west-1      = "ami-7abd0209"
+    sa-east-1      = "ami-26b93b4a"
+    us-east-1      = "ami-6d1c2007"
+    us-west-1      = "ami-af4333cf"
+    us-west-2      = "ami-d2c924b2"
+  }
+}
+
+variable "ssh_user_name" {
+  default = "centos"
+}
+
+provider "aws" {
+  region = "${var.region}"
+}
+
+resource "aws_vpc" "default" {
+  cidr_block = "10.0.0.0/16"
+  tags {
+    Name = "${var.name}"
+  }
+}
+
+resource "aws_internet_gateway" "default" {
+  vpc_id = "${aws_vpc.default.id}"
+  tags {
+    Name = "${var.name}"
+  }
+}
+
+resource "aws_route" "internet_access" {
+  route_table_id         = "${aws_vpc.default.main_route_table_id}"
+  destination_cidr_block = "0.0.0.0/0"
+  gateway_id             = "${aws_internet_gateway.default.id}"
+}
+
+resource "aws_subnet" "default" {
+  vpc_id                  = "${aws_vpc.default.id}"
+  cidr_block              = "10.0.1.0/24"
+  map_public_ip_on_launch = true
+  tags {
+    Name = "${var.name}"
+  }
+}
+
+resource "aws_security_group" "default" {
+  name = "default-elk-test"
+  description = "default security group for elk-test"
+  vpc_id      = "${aws_vpc.default.id}"
+  tags {
+    Name = "${var.name}"
+  }
+
+  ingress {
+    from_port = 22
+    to_port = 22
+    protocol = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port = 5601
+    to_port = 5601
+    protocol = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_key_pair" "auth" {
+  key_name   = "${var.name}"
+  public_key = "${file(var.public_key_path)}"
+}
+
+resource "aws_instance" "elk" {
+  ami = "${lookup(var.amis, var.region)}"
+  instance_type = "m3.medium"
+  vpc_security_group_ids = ["${aws_security_group.default.id}"]
+  subnet_id = "${aws_subnet.default.id}"
+  key_name = "${aws_key_pair.auth.id}"
+  tags {
+    Name = "${var.name}"
+  }
+
+  root_block_device {
+    delete_on_termination = true
+  }
+
+  connection {
+    user = "${var.ssh_user_name}"
+  }
+
+  provisioner "file" {
+    source = "./converge"
+    destination = "/home/${var.ssh_user_name}/converge"
+  }
+
+  provisioner "converge" {
+    params = {
+      user-name = "${var.ssh_user_name}"
+    }
+    modules = [
+      "converge/elk.hcl"
+    ]
+    download_binary = true
+    prevent_sudo = false
+  }
+}
+
+output "ip" {
+  value = "${aws_instance.elk.public_ip}"
+}