I have installed GELF UDP plugin with success in logstash, but 12201 is not open after restarting logstash. Do you know if it is needed additional configuration to start receiving logs from filebeat in graylog?
Currently, the configuration in ELK allows me to receive logs from filebeat, but I would receive the logs in Graylog.
My installation includes ELK 6.6.0, graylog 3.0.0 and mongodb 4.0.6
I have found that I needed to configure logstash.conf in addition: