Collecting syslog (514/udp) with Logstash in Docker swarm

Hello,

we are trying to test Logstash to collect syslogs to replace our in-house syslog collector.
This works fine when our application runs in Docker, the syslogs are sent to the nginx container that forwards them to the syslogs collector

but when running in swarm mode this doesn't work any more.
We can see syslogs (with tcpdump) arriving into the host (centos 7) but they are never forwarded to the nginx container or even directly to the logstash container

Anyone knows about this?

Antoine