"The Logstash output sends the events directly to Logstash by using the lumberjack protocol, which runs over TCP." https://www.elastic.co/guide/en/beats/topbeat/current/logstash-output.html