rsyslog.conf

# Barebones setup for rsyslog, that sends all messages to the Filebeat
# without storing anything locally
$WorkDirectory /var/lib/rsyslog
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

include(file="/etc/rsyslog.d/*.conf" mode="optional")

module(load="immark")
module(load="imuxsock")
module(load="imklog")

*.*     @@filebeat_syslog:9000