However
The native sflow codec seems to bork the udp input
https://discuss.elastic.co/t/logstash-inputs-udp-eoferror-end-of-file-reached/73212
I can't really find anyway to get sflow though logstash these days on ELK 5.2
If anyone has this working, please share