Thanks @rugenl . I did find a deal breaker for filebeat & syslog in our environment. Filebeat seems to treat all syslogs sent to it as if they were created by the host it's running on. That kind of defeats the purpose. All syslogs appear to come from the same host
So it looks like I'm back to Logstash. I was really hoping to use the modules as they do simply just work like you stated.