# Filebeat: How to differentiate data from different types sources on same port?
**URL:** https://discuss.elastic.co/t/filebeat-how-to-differentiate-data-from-different-types-sources-on-same-port/247175
**Category:** Beats
**Tags:** filebeat
**Created:** [September 2, 2020, 6:20am UTC](https://discuss.elastic.co/t/filebeat-how-to-differentiate-data-from-different-types-sources-on-same-port/247175 "2020-09-02T06:20:40Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@denis.atanasov](https://discuss.elastic.co/u/denis.atanasov)
#### Post date: [September 2, 2020, 6:20am UTC](https://discuss.elastic.co/t/filebeat-how-to-differentiate-data-from-different-types-sources-on-same-port/247175/1 "2020-09-02T06:20:40Z")
Hello guys,
I setup a Filebeat (7.9) on my ELK(7.9) and started receiving syslog messages. So far so good, everything is parsed and visualized successfully.
However I am facing problems, when I enable 2 different modules and both are listening for syslog data on the same port - UDP 514? The data cannot be differentiated correctly.
When I modify my module files to listen on different ports, everything is working.
Has anyone run into the same problem?
Denis
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 2, 2020, 6:34am UTC](https://discuss.elastic.co/t/filebeat-how-to-differentiate-data-from-different-types-sources-on-same-port/247175/2 "2020-09-02T06:34:53Z")
We aren't all guys 🙂
The best option you have would be to add a [tag](https://www.elastic.co/guide/en/beats/filebeat/current/add-tags.html) using a [conditional](https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html#where-valid) statement.
---
### Author:  [@denis.atanasov](https://discuss.elastic.co/u/denis.atanasov)
#### Post date: [September 2, 2020, 9:54am UTC](https://discuss.elastic.co/t/filebeat-how-to-differentiate-data-from-different-types-sources-on-same-port/247175/3 "2020-09-02T09:54:45Z")
Hello Mark,
First I want to apologize.
I checked the documentation and test the processor - add\_tags. Successfully added tags, based on different condition.
The problem is when, this data is parsed from the modules.
In example, how to tell to Cisco module to look only for specific data, coming on port UDP/514 and to parse only this?
Thanks,
Denis
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 2, 2020, 9:12pm UTC](https://discuss.elastic.co/t/filebeat-how-to-differentiate-data-from-different-types-sources-on-same-port/247175/4 "2020-09-02T21:12:35Z")
That is just an example, you can call that whatever you want.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 30, 2020, 11:12pm UTC](https://discuss.elastic.co/t/filebeat-how-to-differentiate-data-from-different-types-sources-on-same-port/247175/5 "2020-09-30T23:12:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.