# Enrich port data with a new description field

**URL:** <https://discuss.elastic.co/t/enrich-port-data-with-a-new-description-field/183645>\
**Category:** Logstash\
**Created:** [May 31, 2019, 2:37am UTC](https://discuss.elastic.co/t/enrich-port-data-with-a-new-description-field/183645 "2019-05-31T02:37:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Duked](https://avatars.discourse-cdn.com/v4/letter/d/a4c791/32.png) [@Duked](https://discuss.elastic.co/u/Duked)\
**Post date:** [May 31, 2019, 2:37am UTC](https://discuss.elastic.co/t/enrich-port-data-with-a-new-description-field/183645/1 "2019-05-31T02:37:26Z")

</div>

Hi all,

I'm parsing logs that contains src/dst port information. Now for every port I want to enrich the data by adding a description field. To make it clear:

- Port 22 -\> description = "SSH Traffic"
- Port 80 -\> description = "HTTP Traffic"
- Port 33906 -\> description = "MySQL"

I think how I could do that manually with mutate. But ideally I'd like to either load a csv file (port,description) and do the matching automatically or is there anything that already does that so I don't reinvent the wheel.

---

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [May 31, 2019, 8:36am UTC](https://discuss.elastic.co/t/enrich-port-data-with-a-new-description-field/183645/2 "2019-05-31T08:36:10Z")

</div>

> [@Duked](#):
>
> g logs that contains src/dst port information. Now for every port I want to enrich the data by adding a description field. To m

You can use the translate plugin.

Eg.

```
filter {
if [port] {
		translate {
			id => "translate port to description"
			field => "port"
			destination => "port_description"   
			dictionary => [
				"22","SSH Traffic",
				"80","HTTP Traffic",
				"9999","Whatever traffic"
			]
		}
	}
}

```

if you want it to be externally mapped with a file that you can maintain, do:

```
filter {
if [port] {
	translate {
			id => "translate port to description"
			field => "port"
			destination => "port_description"   
			dictionary_path => "/etc/logstash/conf.d/lookup_tables/your_ports.json"
			fallback => "didnt_work"
	}
}
}

```

> {"22":"SSH Traffic","80":"HTTP Traffic"}

---

<div class="post-metadata">

**Author:** ![Duked](https://avatars.discourse-cdn.com/v4/letter/d/a4c791/32.png) [@Duked](https://discuss.elastic.co/u/Duked)\
**Post date:** [May 31, 2019, 12:52pm UTC](https://discuss.elastic.co/t/enrich-port-data-with-a-new-description-field/183645/3 "2019-05-31T12:52:45Z")

</div>

Awesome thanks a lot for the direction I wasn't aware of the translate plugins.

I'm basically modifying the linux standard port definition in /etc/services but I realize I'll need 2 value to match the description:  
"22, TCP: SSH"

Looking at the doc of the plugin this seems to be the correct format:  
20 6: ftp-data  
21 6: ftp  
21 17: fsp  
22 6: ssh  
23 6: telnet  
25 6: smtp  
37 6: time  
37 17: time

(where 6 is tcp and 17 UDP). I'll test it and make sure it works and I'll update the tag and post the file in case someone might find it useful.

Thanks @pastechecker !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2019, 12:52pm UTC](https://discuss.elastic.co/t/enrich-port-data-with-a-new-description-field/183645/4 "2019-06-28T12:52:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.