MariuszL We can do it as below: output { syslog { host => "127.0.0.1" port => 514 protocol => "tcp" rfc => "rfc3164" } }