Beats can send logs either to Logstash, Elasticsearch or Kafka. I gave the protocol used with Elasticsearch a try, but it does not work unfortunately. It's a two way protocol, so even if I got JSON sent by Beats parsed by syslog-ng, communication died quickly between the two. Finally I gave up and used Logstash between Beats and syslog-ng, just as Scot. My blog discusses extracting original syslog messages from messages collected by filebeat: https://www.balabit.com/blog/sending-logs-logstash-syslog-ng/ Other Beats messages should work similarly and you can most likely spare some of the dark magic employed :)