# Identifying Unique Log Sources

**URL:** <https://discuss.elastic.co/t/identifying-unique-log-sources/233380>\
**Category:** Logstash\
**Created:** [May 19, 2020, 5:03pm UTC](https://discuss.elastic.co/t/identifying-unique-log-sources/233380 "2020-05-19T17:03:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![phinkel](https://avatars.discourse-cdn.com/v4/letter/p/da6949/32.png) [@phinkel](https://discuss.elastic.co/u/phinkel)\
**Post date:** [May 19, 2020, 5:03pm UTC](https://discuss.elastic.co/t/identifying-unique-log-sources/233380/1 "2020-05-19T17:03:30Z")

</div>

Hello,

We are attempting to start collecting from our first ESXi host and getting the logs to logstash is any easy process however, our goal is to take multiple log source types (asa, cisco switch, esxi, etc.) all on the common syslog UDP or TCP 514 port. We would like to have the ability to tag each of these as unique sources. With esxi we cannot find a unique string or pattern to identify it as ESXi specific. The logs from esxi seem to be generic syslog events with nothing to distinguish them as esxi.

A solution to this could be using different ports and identifying them this way. However, is there any documentation or way of recognizing an esxi source through the raw syslog?

Thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 20, 2020, 10:53pm UTC](https://discuss.elastic.co/t/identifying-unique-log-sources/233380/2 "2020-05-20T22:53:43Z")

</div>

Welcome! 😃

Not that I have seen, I think most solutions involved a specific input port, and then tagging that input.

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [May 21, 2020, 5:38am UTC](https://discuss.elastic.co/t/identifying-unique-log-sources/233380/3 "2020-05-21T05:38:23Z")

</div>

at best you can split them by host, as it is an identifier in proper syslog. you could probably maintain a dictionary of servers and type for example

`“host-a”: esxi`

then using a translate filter , you can dynamically add type to the incoming log message. all you need to do is update your dictionary if you have new log source

---

<div class="post-metadata">

**Author:** ![phinkel](https://avatars.discourse-cdn.com/v4/letter/p/da6949/32.png) [@phinkel](https://discuss.elastic.co/u/phinkel)\
**Post date:** [May 21, 2020, 3:26pm UTC](https://discuss.elastic.co/t/identifying-unique-log-sources/233380/4 "2020-05-21T15:26:50Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2020, 3:26pm UTC](https://discuss.elastic.co/t/identifying-unique-log-sources/233380/5 "2020-06-18T15:26:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.