# Filter by multiple source ports

**URL:** <https://discuss.elastic.co/t/filter-by-multiple-source-ports/361500>\
**Category:** Logstash\
**Created:** [June 14, 2024, 1:13pm UTC](https://discuss.elastic.co/t/filter-by-multiple-source-ports/361500 "2024-06-14T13:13:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmercaldi](https://avatars.discourse-cdn.com/v4/letter/m/a3d4f5/32.png) [@mmercaldi](https://discuss.elastic.co/u/mmercaldi)\
**Post date:** [June 14, 2024, 1:13pm UTC](https://discuss.elastic.co/t/filter-by-multiple-source-ports/361500/1 "2024-06-14T13:13:34Z")

</div>

I have 2 different streams going into the same logstash instance. I want it so if the sourceport is 5510 output to connection A and if sourceport is 5511 output to connection B. But I do not know how to reference the source port in filter or output. The input is:

```auto
input {
 udp {
   port => 5510
 }
 udp {
   port => 5511
 }}}

```

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [June 14, 2024, 1:27pm UTC](https://discuss.elastic.co/t/filter-by-multiple-source-ports/361500/2 "2024-06-14T13:27:35Z")

</div>

> [@mmercaldi](#):
>
> I have 2 different streams going into the same logstash instance. I want it so if the sourceport is 5510 output to connection A and if sourceport is 5511 output to connection B. But I do not know how to reference the source port in filter or output. The input is:
> 
> ```auto
> input {
> udp {
> port => 5510
> }
> udp {
> port => 5511
> }}}
> 
> ```

Hi,

you can add a custom field in your input block, which will then be available in the event data.

```auto
input {
  udp {
    port => 5510
    add_field => { "sourceport" => "5510" }
  }
  udp {
    port => 5511
    add_field => { "sourceport" => "5511" }
  }
}

output {
  if [sourceport] == "5510" {
    # connection A
  } else if [sourceport] == "5511" {
    # connection B
  }
}

```

Regards

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 14, 2024, 1:39pm UTC](https://discuss.elastic.co/t/filter-by-multiple-source-ports/361500/3 "2024-06-14T13:39:31Z")

</div>

You may add a custom field o tag to use in filtering later in the pipeline.

But if those are two different data sources it would be recommended to use different pipelines.

Are you using the same filters for both data?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [June 14, 2024, 2:26pm UTC](https://discuss.elastic.co/t/filter-by-multiple-source-ports/361500/4 "2024-06-14T14:26:52Z")

</div>

3rd option, and not last is:

```auto
input {
 udp {
   port => 5510
   type => "5510"
 }
 udp {
   port => 5511
   type => "5511"
 }
}

```