I am not sure which OS you are running. But I had nothing but trouble with the setcap method on Centos 7.3, where it worked on 6.8 without issue. So, as Magnus suggests, I tried the port redirection. But I leverage firewall-cmd rather than the iptables commands. Here are my working methods for forwarding syslog 514 to 5514:
#UDP Rule
sudo firewall-cmd --add-forward-port=port=514:proto=udp:toport=5514:toaddr=127.0.0.1 --permanent
#TCP Rule
sudo firewall-cmd --add-forward-port=port=514:proto=tcp:toport=5514:toaddr=127.0.0.1 --permanent
Restart firewalld
sudo systemctl restart firewalld
Then, all I had to do was update my Logstash input conf to listen on 5514 instead of 514, events are flowing into Elasticsearch now, hope this helps!