source s_2514 { tcp(port(2514)); };

# Assuming remote linux machine forwarding logs to syslog-ng server's tcp port 2514.

destination d_remote_linux1 { tcp("127.0.0.1" port(9200) template("$(format-json --scope selected_macros --scope nv_pairs)\n")); };

# Change the above IP -> 127.0.0.1 to your elastic server's IP

filter f_remote_linux1 {  '' your filter " ; };

# Apply whatever filter you want, you can use multiple filters as well.

log {

         source(s_2514);

         filter(f_remote_linux1);

         destination(d_remote_linux1);

    };