Syslog message: Tag problem and bad facility and severity values in the output of logstash

I had similar frustrations with the syslog input. I just use tcp or udp input with my own grok. Can see here for a start but update the grok pattern accordingly.