Since Filebeat is installed directly on the machine, it makes sense to allow Filebeat to collect local syslog data and send it to Elasticsearch or Logstash. With the currently available filebeat prospector it is possible to collect syslog events via UDP.

POC

{
  "_index": "filebeat-6.0.1-2017.12.12",
  "_type": "doc",
  "_id": "mO8YTGABuTrMYTLosnUm",
  "_score": 1,
  "_source": {
    "@timestamp": "2017-12-12T18:59:34.077Z",
    "message": "<13>Dec 12 18:59:34 testing root: Hello PH <3",
    "prospector": {
      "type": "udp"
    },
    "beat": {
      "name": "testing",
      "hostname": "testing",
      "version": "6.0.1"
    }
  },
  "fields": {
    "@timestamp": [
      "2017-12-12T18:59:34.077Z"
    ]
  }
}

Filebeat configuration:

- type: udp                                                                                                                                                   
  enabled: true

Rsyslog configuration:

*.* @127.0.0.1:8080

TODO:

• Evaluate the experimental status of UDP
• Decide which syslog format to support
• Create an Ingest pipeline to extract the data.
• Discuss if using the UDP type instead of syslog is confusing for the user, should we create a specific type for syslog.

Related links:
See existing Logstash plugins concerning syslog.
https://github.com/logstash-plugins/?utf8=%E2%9C%93&q=syslog&type=&language=