New to ELK (Syslog issue)

Have you tried specifically bonding a given host IP and/or port?

If you run with the --verbose or --debug flags, do you see more information regarding the syslog input plugin?