Filter by multiple source ports

Elastic Stack Logstash
1

I have 2 different streams going into the same logstash instance. I want it so if the sourceport is 5510 output to connection A and if sourceport is 5511 output to connection B. But I do not know how to reference the source port in filter or output. The input is:

input {
 udp {
   port => 5510
 }
 udp {
   port => 5511
 }}}
2

Hi,

you can add a custom field in your input block, which will then be available in the event data.

input {
  udp {
    port => 5510
    add_field => { "sourceport" => "5510" }
  }
  udp {
    port => 5511
    add_field => { "sourceport" => "5511" }
  }
}

output {
  if [sourceport] == "5510" {
    # connection A
  } else if [sourceport] == "5511" {
    # connection B
  }
}

Regards

1 Like
3

You may add a custom field o tag to use in filtering later in the pipeline.

But if those are two different data sources it would be recommended to use different pipelines.

Are you using the same filters for both data?

1 Like
4

3rd option, and not last is:

input {
 udp {
   port => 5510
   type => "5510"
 }
 udp {
   port => 5511
   type => "5511"
 }
}