you might find this part of the documentation helpful: http://docs.graylog.org/en/2.5/pages/secure/sec_graylog_beats.html