# Aggregate Logs based on Source IP
**URL:** https://discuss.elastic.co/t/aggregate-logs-based-on-source-ip/343789
**Category:** SIEM
**Created:** [September 25, 2023, 4:16pm UTC](https://discuss.elastic.co/t/aggregate-logs-based-on-source-ip/343789 "2023-09-25T16:16:26Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@maof97](https://discuss.elastic.co/u/maof97)
#### Post date: [September 25, 2023, 4:16pm UTC](https://discuss.elastic.co/t/aggregate-logs-based-on-source-ip/343789/1 "2023-09-25T16:16:26Z")
Hello,
I'm collecting firewall logs from a firewall (PfSense).
On every log record, among other details, I have destination ip addresses and destination ports.
Now, I need to have an aggregated list of all destination ip addresses and destination ports for a source ip.
src 10.1.1.177:50022 dst 10.2.1.1:80
src 10.1.1.1:5000 dst 10.2.1.1:443
src 10.1.1.54:5000 dst 10.2.1.1:443
src 10.1.1.85:5000 dst 10.2.1.1:443
src 10.1.1.1:50022 dst 10.2.2.1:990
src 10.1.1.112:50022 dst 10.2.2.1:990
src 10.1.1.177:50022 dst 10.2.2.1:990
From the example above I want the aggregation of destination+port combinations for 10.2.1.171:
10.2.1.1:80
10.2.2.1:990
I tried the 'correlation' in the timeline using EQL but it didn't work.
Can anybody help me?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 23, 2023, 4:16pm UTC](https://discuss.elastic.co/t/aggregate-logs-based-on-source-ip/343789/2 "2023-10-23T16:16:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.