I have Debian 10 running on ESXI and graylog installed on top of it per the graybar/debian instructions. I am able to access the web interface on port 9000.
I created my first input for syslog info using UDP port 5140 and setup a few network devices to send the syslogs to the graylog IP and port 5140.
Using TCPDUMP, I see the traffic hitting the Interface but nothing making it to graylog.
The Syslog config:
allow_override_date: true
bind_address: 10.14.20.47
expand_structured_data: false
force_rdns: false
number_worker_threads: 4
override_source: <empty>
port: 5140
recv_buffer_size: 262144
store_full_message: false