I've setup ELK on Windows 2012 and can't seem to get the syslog working.
So at this stage my logstash.json file has a simple input for syslog.
port => 5044
type => log
If I save this and restart the logstash service I would expect netstat -a | find "514" to return a listener but it's not.
The filebeats, winlogbeats and topbeat are functioning as expected.
If I do a logstash-plugin list --verbose I can see that logstash-input-syslog is version (2.0.5).
So my question is does someone have a simple setup documented I can review for syslog on windows.