How can I bind 514 so it can be used by graylog.
There are examples like
iptables -t nat -A PREROUTING -i eth0 -p udp -m udp --dport 514 -j REDIRECT --to-ports 5514
But what I want is to use 514 using root.
You can use authbind to allow the Graylog Java process to bind to a privileged port (below 1024).
Depending on how you've installed Graylog, you can simply edit the start script configuration file (see default file locations) and add authbind
as a command wrapper.
Also take a look at the example.