# Filtering Issues with Logstash

**URL:** <https://discuss.elastic.co/t/filtering-issues-with-logstash/26635>\
**Category:** Logstash\
**Created:** [July 31, 2015, 10:07am UTC](https://discuss.elastic.co/t/filtering-issues-with-logstash/26635 "2015-07-31T10:07:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zeal\_Vora](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zeal_vora/32/3946_2.png) [@Zeal\_Vora](https://discuss.elastic.co/u/Zeal_Vora)\
**Post date:** [July 31, 2015, 10:07am UTC](https://discuss.elastic.co/t/filtering-issues-with-logstash/26635/1 "2015-07-31T10:07:16Z")

</div>

Hi

I am new to ELK stack and have setup basic ELK Stack. I am using fluentd to foward logs to Logstash.

Here is my basic configuration file for logstash.

input {

```
 syslog {

 type => syslog

 port => 5141

```

}

}

output {

stdout { }

elasticsearch {

}

}

Currently as I am using syslog plugin in " input ". The syslog automatically segregates the data and i get nice formatted data in Kibana.

But if i send audit.logs , as it's not part of syslog, the syslog does not parse them properly.

What if i want to parse the audit.logs coming from remote servers with grok plugin ? The logs are coming from remote server to port 5141.

If i add grok in filter section with appropriate pattern, will grok leave aside the syslog logs and parse the audit.logs that are coming via syslog input block ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 31, 2015, 5:48pm UTC](https://discuss.elastic.co/t/filtering-issues-with-logstash/26635/2 "2015-07-31T17:48:06Z")

</div>

To apply different filters to different kinds of messages, use conditional blocks.

```
filter {
  if ... {
    grok {
      ...
    }
  }
}

```

Since all messages arrive on the same port and the same input I'm not sure what condition you should use when choosing the filter(s) to use. With examples of both kinds of messages I'd be in a better situation to help.

---

<div class="post-metadata">

**Author:** ![Zeal\_Vora](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zeal_vora/32/3946_2.png) [@Zeal\_Vora](https://discuss.elastic.co/u/Zeal_Vora)\
**Post date:** [August 4, 2015, 7:32am UTC](https://discuss.elastic.co/t/filtering-issues-with-logstash/26635/3 "2015-08-04T07:32:25Z")

</div>

Thanks. What would be the ideal way to do it instead of sending all data to the same port ?

Should i use multiple ports where 1 port will receive syslog messages and other port for different kind of messages ? Not sure.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 4, 2015, 7:35am UTC](https://discuss.elastic.co/t/filtering-issues-with-logstash/26635/4 "2015-08-04T07:35:53Z")

</div>

There is no perfect and ideal way. It depends on your data and what makes sense in your situation. You could definitely use two different ports but if that's easier than writing a regular expression to distinguish between the different kinds of messages.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/filtering-issues-with-logstash/26635/5 "2017-07-06T05:33:01Z")

</div>