Distinguish between syslog inputs

Hi,

There are a couple of ways you can do that.

  1. Have a separate Logstash input for each source (different ports) and tag/add fields on each source respectively.
  2. Filter based on the "host" field that should be available and contain the originating IP/hostname, if you know them beforehand.

More options could be available depending on the setup, but those above should be the most straightforward.