logstash is not syslog listener
restored rsyslog server
includes elasticsearch