Needed some test @logstash events. Use file plugin to grab /var/log/auth.log on a @digitalocean host with port 22 open. Problem solved. :)