# Indexing a Modbus over TCP packet with Logstash

**URL:** <https://discuss.elastic.co/t/indexing-a-modbus-over-tcp-packet-with-logstash/44622>\
**Category:** Logstash\
**Created:** [March 16, 2016, 9:04pm UTC](https://discuss.elastic.co/t/indexing-a-modbus-over-tcp-packet-with-logstash/44622 "2016-03-16T21:04:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nba](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@nba](https://discuss.elastic.co/u/nba)\
**Post date:** [March 16, 2016, 9:04pm UTC](https://discuss.elastic.co/t/indexing-a-modbus-over-tcp-packet-with-logstash/44622/1 "2016-03-16T21:04:47Z")

</div>

I am trying to index a pcap capture witch composed by a Modbus/TCP encapsulation.  
So before writing my own modbus.conf file to parse all field, I want to know is there something like that ? I am looking for a simply pcap parser witch I can complete with decoded Modbus PDU ?

Than I will use the result in ElastickSearch to make some query.

Thank you for your answer.

---

<div class="post-metadata">

**Author:** ![jhk](https://avatars.discourse-cdn.com/v4/letter/j/d6d6ee/32.png) [@jhk](https://discuss.elastic.co/u/jhk)\
**Post date:** [January 30, 2017, 7:02am UTC](https://discuss.elastic.co/t/indexing-a-modbus-over-tcp-packet-with-logstash/44622/2 "2017-01-30T07:02:52Z")

</div>

Hi nba,

I am looking to do something similar. Did you get it working? Any pointer you can share?

Thank you,

jhk

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:29am UTC](https://discuss.elastic.co/t/indexing-a-modbus-over-tcp-packet-with-logstash/44622/3 "2017-07-06T04:29:05Z")

</div>

Closed on July 6, 2017, 4:29am UTC