logstash/cookbook — pull request #89 by dnozay (2014-03-03 18:27:42+00:00)
Title: Don't use port 5544 which is known to be used by a trojan/worm

see http://www.speedguide.net/port.php?port=5544
port 5544 is known to be used by certain worm/trojan.
It's better if the user did not open up a hole in their firewall.

plus 10514 is more common for user defined rsyslog port.