McAfee Epolicy Orchestrator

Locate the registered servers page (under configuration) in McAfee Epolicy Orchestrator.

Now change the server type to syslog server and enter a suitable name for the connection, now hit next.

Press next and you'll be presented with an option for the syslog server and syslog port.

Enter your Logstash endpoint address your-logstash-host and syslog-ssl port number your-ssl-port

Once you have entered the details you can test the connection using the button on screen.