# How can I deny the log message sent by unknown source? Thanks

**URL:** <https://discuss.elastic.co/t/how-can-i-deny-the-log-message-sent-by-unknown-source-thanks/83153>\
**Category:** Logstash\
**Created:** [April 21, 2017, 6:41am UTC](https://discuss.elastic.co/t/how-can-i-deny-the-log-message-sent-by-unknown-source-thanks/83153 "2017-04-21T06:41:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![leftstar\_200](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@leftstar\_200](https://discuss.elastic.co/u/leftstar_200)\
**Post date:** [April 21, 2017, 6:41am UTC](https://discuss.elastic.co/t/how-can-i-deny-the-log-message-sent-by-unknown-source-thanks/83153/1 "2017-04-21T06:41:01Z")

</div>

Hello all,

I am receiving the Syslog using Logstash as Syslog server. My client machine sends the massage to Logstash server.

My question is how can I specify which one or more client machines are valid to avoid disallowed machine sends the syslog message to my Logstash server once he known my Logstash IP address and port?

I can't implement it via FILTERof Logstash because I am worry about performance issue. So I am looking for a internal mechanism of Logstash that can refuses unknown syslog likes IPTABLE before received by INPUT

Thanks a lot

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 21, 2017, 7:32am UTC](https://discuss.elastic.co/t/how-can-i-deny-the-log-message-sent-by-unknown-source-thanks/83153/2 "2017-04-21T07:32:08Z")

</div>

Apart from using filters Logstash has no functionality to reject connections from certain clients. Why not use the firewall for this?

---

<div class="post-metadata">

**Author:** ![leftstar\_200](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@leftstar\_200](https://discuss.elastic.co/u/leftstar_200)\
**Post date:** [April 21, 2017, 8:05am UTC](https://discuss.elastic.co/t/how-can-i-deny-the-log-message-sent-by-unknown-source-thanks/83153/3 "2017-04-21T08:05:38Z")

</div>

Thanks for your reply. If no internal mechanism, I will use firewall to implement this. Thanks a lot!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 19, 2017, 8:05am UTC](https://discuss.elastic.co/t/how-can-i-deny-the-log-message-sent-by-unknown-source-thanks/83153/4 "2017-05-19T08:05:46Z")

</div>

Closed on May 19, 2017, 8:05am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.