[syslog-ng] ES destination node or SLB ?