Yes ALL beats traffic can use the same TCP port and input config.   I use logstash as an aggregation point for beats endpoints then send directly to syslog-ng. 
Tested Filebeat Linux/Windows, winlogbeat, packetbeat and metricbeat.


See my thread Re: [syslog-ng] Syslog-ng input for beats ? [SUMMARY01]



On Thu, Nov 2, 2017 at 10:51 AM, Czanik, Péter <peter.czanik@balabit.com> wrote:
Hi,

Somehow related to my previous e-mail: I was asked if Filebeat can send logs directly into syslog-ng.

None of the network destinations of Beat are supported by syslog-ng, but I did a quick check and we can read and parse the file destination of Beat.

Filebeat module functionality can be practically replaced by syslog-ng and one of its parsers. But there are quite a few other Beat applications.

Question: is there a practical use case for syslog-ng reading the file output of a Beat module? Do you use it anywhere?

Bye,


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq