input { udp { host => "0.0.0.0" port => 5228 codec => syslog } } output { elasticsearch_http { user => "ES_USER" password => "ES_PASSWORD" host => "ES_HOST" port => "ES_PORT" } }