# How to create logstash for different network device over same udp port

**URL:** <https://discuss.elastic.co/t/how-to-create-logstash-for-different-network-device-over-same-udp-port/262879>\
**Category:** Logstash\
**Created:** [February 1, 2021, 5:54pm UTC](https://discuss.elastic.co/t/how-to-create-logstash-for-different-network-device-over-same-udp-port/262879 "2021-02-01T17:54:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sajiby3k](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@sajiby3k](https://discuss.elastic.co/u/sajiby3k)\
**Post date:** [February 1, 2021, 5:54pm UTC](https://discuss.elastic.co/t/how-to-create-logstash-for-different-network-device-over-same-udp-port/262879/1 "2021-02-01T17:54:19Z")

</div>

Hi,

I am very new to elk stack.

Trying to use logstash for Cisco routers and Fortigate firewalls.

Both of these device types will use default udp port 514 to logstash to send log files.

Most basic configuration looks like below for input.

input{  
udp{  
port =\> 514  
type =\> "log4net"  
}  
}

But with this setup I cannot differenciate which is a fortigate and which is a cisco log.

I try to avoid configure a unique udp port for each type of device from different vendors.

The goal is not gork data for additional fields according to their log contents.

Any help. Or I am missing something obivios.

Regards.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 1, 2021, 11:04pm UTC](https://discuss.elastic.co/t/how-to-create-logstash-for-different-network-device-over-same-udp-port/262879/2 "2021-02-01T23:04:47Z")

</div>

Welcome to our community! 😃

Using different ports is the best option. If not, you might be able to tag them based on specific information each log format contains?

---

<div class="post-metadata">

**Author:** ![sajiby3k](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@sajiby3k](https://discuss.elastic.co/u/sajiby3k)\
**Post date:** [February 2, 2021, 7:32am UTC](https://discuss.elastic.co/t/how-to-create-logstash-for-different-network-device-over-same-udp-port/262879/3 "2021-02-02T07:32:15Z")

</div>

@warkolm

Can you explain what the host in input udp does?

> **[Udp input plugin | Logstash Reference \[7.10\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-udp.html#plugins-inputs-udp-host)**

What is the - Host value - my logstsash IP adress or the device sending the syslog data (Cisco/Fortigate)?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 2, 2021, 8:29am UTC](https://discuss.elastic.co/t/how-to-create-logstash-for-different-network-device-over-same-udp-port/262879/4 "2021-02-02T08:29:54Z")

</div>

The docs state;

> The address which logstash will listen on

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2021, 8:30am UTC](https://discuss.elastic.co/t/how-to-create-logstash-for-different-network-device-over-same-udp-port/262879/5 "2021-03-02T08:30:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.