You'll know that syslog usually uses port 514, not port 5140. On the logstash server, you can make sure you are actually receiving data on port 5140, with tcpdump or similar tools. Or, as @Rios suggested, generate some traffic yourself, with telnet, or netcat, or bash even.
iptables and/or other firewalls may need to be disabled / re-configured.
Obviously, if the data is reaching elasticsearch's syslog-* indices then it is flowing, is that the case?
See my other response.
And a belated "Welcome to the forum!! @sysrq_1231 !!"
(and, in passing and just to check, you have 2 elasticsearch IPs listed. I hope that is 2 from N elasticsearch nodes in your cluster, where N>=3?)