# Logstash iptables log parse
**URL:** https://discuss.elastic.co/t/logstash-iptables-log-parse/122389
**Category:** Logstash
**Created:** [March 3, 2018, 9:26pm UTC](https://discuss.elastic.co/t/logstash-iptables-log-parse/122389 "2018-03-03T21:26:00Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@jerryhwang72](https://discuss.elastic.co/u/jerryhwang72)
#### Post date: [March 3, 2018, 9:26pm UTC](https://discuss.elastic.co/t/logstash-iptables-log-parse/122389/1 "2018-03-03T21:26:01Z")
Hi,
ELK run in containers.
I setup iptables send all input/forward/output logs to logstash. example log seen on kibana discover pane.
@version:1 host:3.3.3.3 @timestamp:March 3rd 2018, 12:14:45.220 message:\<4\>Mar 3 20:14:47 myhost kernel: [2242132.946331] LOG\_ALL\_TRAF public INPUT IN=public OUT= MAC=00:1e:67:f2:db:28:00:1e:67:f2:d9:7c:08:00 SRC=1.1.1.1 DST=2.2.2.2 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=17722 DF PROTO=TCP SPT=3504 DPT=8080 WINDOW=512 RES=0x00 ACK URGP=0 type:rsyslog tags:\_jsonparsefailure \_id:AWHtgJ\_qYRe3mIjckQsb \_type:rsyslog \_index:logstash-2018.03.03 \_score: -
The entire log is categorized as 'message' field on kibana discover view.
But I wish to use SRC, DST, SPT, DPT etc as each individual field and then also use them to visualize.
Any guidance is much appreciated.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 4, 2018, 7:03pm UTC](https://discuss.elastic.co/t/logstash-iptables-log-parse/122389/2 "2018-03-04T19:03:32Z")
So you have a standard syslog message (see example in the Logstash documentation) but on top of that you want to parse the message part to extract additional fields. Have a look at the kv filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 1, 2018, 7:04pm UTC](https://discuss.elastic.co/t/logstash-iptables-log-parse/122389/3 "2018-04-01T19:04:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.