Sending from an In-house Relay

This is the preferred sending option since it doesn't require the specification of authentication certificates in the Logstash configuration file. 

The example below highlights the output section of the configuration file and shows that the events are sent to port 13000 on localhost. Port 13000 is used since we specify the tag in the appname variable. 

input {...}
output {

	syslog {
        facility => "local7"
        severity => "informational"
    	host => "localhost"						
    	port => 13000 						### send to port 13000 so the relay resend it to Devo
        sourcehost => "syslogHostname" 		### syslog message hostname
    	appname => "av.mcafee.epo.events"   ### syslog message tag
        protocol => "tcp"
	}
}