# How to different syslog in the same port? **URL:** \ **Category:** Logstash\ **Created:** [January 23, 2022, 8:46am UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134 "2022-01-23T08:46:51Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![baalchina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baalchina/32/100690_2.png) [@baalchina](https://discuss.elastic.co/u/baalchina)\ **Post date:** [January 23, 2022, 8:46am UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134/1 "2022-01-23T08:46:52Z")
Hi all, I have many network devices, I forward their syslog to a logstash server, and then to elastisearch. In logstash, I start many ports, such 514,515,516... and each port to different log types, and when output to es, one type to one index, so I can make index pattern in kibana in a easy way. Here is the problem: some old devices can only forward syslog to port 514 than any other port. That means in the default port, many different type of devices in a same index. So, I want to know, how to solve this? My purpose is to split different device's syslog so I can use different grok pattern in the logstash filter. Thanks. ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [January 23, 2022, 12:12pm UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134/2 "2022-01-23T12:12:49Z")
I would look at your data and see if there is any unique features you can use to separate them and then use [conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) to access them. Maybe `log.file.path`? ---
**Author:** ![baalchina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baalchina/32/100690_2.png) [@baalchina](https://discuss.elastic.co/u/baalchina)\ **Post date:** [January 23, 2022, 1:35pm UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134/3 "2022-01-23T13:35:19Z")
well, I looked this syslog, the ip addr may be useful. a log in kibana like this ```auto { "_index": "syslog-generic-20220123", "_type": "_doc", "_id": "fzAZh34BidnVrFlllwQe", "_version": 1, "_score": 1, "_source": { "facility": 0, "@timestamp": "2022-01-23T13:21:48.215Z", "host": "1.2.3.4", "facility_label": "kernel", "type": "syslog-generic", "priority": 0, "message": "<134>dnscache: 1642944108 2022-01-23 21:21:48 queries:litedev.ys7.com IN A from client 10.150.0.134#60923,dns_server 1.2.3.4:53 responds to:112.17.34.109,about line:2,set MARK:0x2010403\n", "severity": 0, "severity_label": "Emergency", "tags": [ "_grokparsefailure_sysloginput" ], "@version": "1" }, "fields": { "severity": [ 0 ], "tags.keyword": [ "_grokparsefailure_sysloginput" ], "@version.keyword": [ "1" ], "severity_label.keyword": [ "Emergency" ], "type": [ "syslog-generic" ], "message": [ "<134>dnscache: 1642944108 2022-01-23 21:21:48 queries:litedev.ys7.com IN A from client 10.150.0.134#60923,dns_server 1.2.3.4:53 responds to:112.17.34.109,about line:2,set MARK:0x2010403\n" ], "priority": [ 0 ], "tags": [ "_grokparsefailure_sysloginput" ], "@timestamp": [ "2022-01-23T13:21:48.215Z" ], "type.keyword": [ "syslog-generic" ], "message.keyword": [ "<134>dnscache: 1642944108 2022-01-23 21:21:48 queries:litedev.ys7.com IN A from client 10.150.0.134#60923,dns_server 1.2.3.4:53 responds to:112.17.34.109,about line:2,set MARK:0x2010403\n" ], "host": [ "1.2.3.4" ], "@version": [ "1" ], "host.keyword": [ "1.2.3.4" ], "facility": [ 0 ], "facility_label.keyword": [ "kernel" ], "severity_label": [ "Emergency" ], "facility_label": [ "kernel" ] } } ``` in the json log, "1.2.3.4"is the unique source of the device. So, the probelm becomes, how to ideneitify the ip addr in logstash filter? I tried this ```auto input{ syslog{ type => "syslog-generic" host => "ip-addr-of-logstash" port => 514 } } filter { if ([fields][host] == "1.2.3.4") { mutate { replace => { "[type]" => "syslog-dns-query" } } } } output { if [type] == "syslog-dns-query" { elasticsearch { hosts => ["myes-addr"] user => "elastic" password => "changeme" index => "syslog-dns-query-%{+YYYYMMdd}" } } } ``` But no index named syslog-dns\* appears in kibana. So, anything wrong? Thank you . ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [January 23, 2022, 1:57pm UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134/4 "2022-01-23T13:57:18Z")
> [@baalchina](#): > > ```auto > "host": [ > "1.2.3.4" > ] > > ``` Your host is an array. So you need to access the first element in the array. Be aware since it's an array it might change and add more hosts in there. I would verify you are only ever going to get 1 in order for this to work. `if ([fields][host][0] == "1.2.3.4") {` ---
**Author:** ![baalchina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baalchina/32/100690_2.png) [@baalchina](https://discuss.elastic.co/u/baalchina)\ **Post date:** [January 23, 2022, 2:28pm UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134/5 "2022-01-23T14:28:32Z")
Thank you. Well, I tried, seems didn't work... I noticed the host is a text, like this: ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/f/cf125819c33c7d958321a8aa2292be9d9a73d720.png) So can I use this in filter? ```auto input{ syslog{ type => "syslog-generic" host => "ip-addr-of-logstash" port => 514 } } filter { if ([_source][host] == "1.2.3.4") { mutate { replace => { "[type]" => "syslog-dns-query"} } } } ``` At first, the syslog from port 514 get a type of "syslog-generic" in input section, and then in filter section we changed the type to "syslog-dns-query" where \_source host is "1.2.3.4". unfortunately it doesn't work...I can not find any index named syslog-dns-query in my kibana. ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [January 23, 2022, 2:43pm UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134/6 "2022-01-23T14:43:36Z")
If it's field `host` then you would just do this. Don't need the `_source`. ```auto if [host] == "1.2.3.4" { ``` ---
**Author:** ![baalchina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baalchina/32/100690_2.png) [@baalchina](https://discuss.elastic.co/u/baalchina)\ **Post date:** [January 23, 2022, 3:22pm UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134/7 "2022-01-23T15:22:24Z")
well...I made a stupid mistake... The right filter is ` if [host] == "1.2.3.4" {` and I uesed this: ` if ([host] == "1.2.3.4") {` now, it works fine. The filter section now this: ```auto input{ syslog{ type => "syslog-generic" host => "ip-addr-of-logstash" port => 514 } } filter { if [host] == "1.2.3.4" { mutate { replace => { "[type]" => "syslog-dns-query"} } } } ``` Thanks for help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 20, 2022, 3:23pm UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134/8 "2022-02-20T15:23:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.