never played with syslogd. I prefer TLS server now, but in the past I've done this kind of work with filebeat