logs ingest endpoint — use TLS syslog on :6514