tcp: gives the hostname of the localmachine not the ip of remote machine...

... which for input this may work better, unix and zeromq now both support chmod, chgrp, and chown since sockets need the option to change permissions

Not sure if this is all okay with everyone else but what i do to run it. Because the logstash processes is started by a user that is not also the user that is generating the logs this is better then trying to always change the permisions all the time.