# Logstash is not filtering snort

**URL:** <https://discuss.elastic.co/t/logstash-is-not-filtering-snort/99159>\
**Category:** Logstash\
**Created:** [September 1, 2017, 5:44pm UTC](https://discuss.elastic.co/t/logstash-is-not-filtering-snort/99159 "2017-09-01T17:44:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kanan930](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kanan930/32/21763_2.png) [@kanan930](https://discuss.elastic.co/u/kanan930)\
**Post date:** [September 1, 2017, 5:44pm UTC](https://discuss.elastic.co/t/logstash-is-not-filtering-snort/99159/1 "2017-09-01T17:44:23Z")

</div>

Hi all,  
I am trying to filter snort alerts. I need to display the output on kibana dashboard. I have created the filtering script "logstash\_snort.conf" in /opt/bitnami/logstash/conf directory. logstash is running fine, however, it seems snort alerts are not filtered.

input {  
udp {  
type =\> snort  
port =\> 5044  
}  
}  
filter {  
.......}

I am assuming the port is the same as indicated in our filebeat file.

Should I modify logstash.conf ??

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 4, 2017, 5:38am UTC](https://discuss.elastic.co/t/logstash-is-not-filtering-snort/99159/2 "2017-09-04T05:38:00Z")

</div>

So have you configured Snort to send UDP packets to port 5044 on the Logstash host?

> I am assuming the port is the same as indicated in our filebeat file.

Receiving UDP packets from snort has nothing to do with Filebeat and Filebeat uses TCP.

---

<div class="post-metadata">

**Author:** ![kanan930](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kanan930/32/21763_2.png) [@kanan930](https://discuss.elastic.co/u/kanan930)\
**Post date:** [September 5, 2017, 3:31pm UTC](https://discuss.elastic.co/t/logstash-is-not-filtering-snort/99159/3 "2017-09-05T15:31:03Z")

</div>

Should I change the protocol to TCP instead of UDP?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 5, 2017, 7:21pm UTC](https://discuss.elastic.co/t/logstash-is-not-filtering-snort/99159/4 "2017-09-05T19:21:35Z")

</div>

You can use either TCP or UDP as far as Logstash is concerned. That's up to you. Just make sure your configuration matches the choice you make on the Snort side.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 3, 2017, 7:21pm UTC](https://discuss.elastic.co/t/logstash-is-not-filtering-snort/99159/5 "2017-10-03T19:21:58Z")

</div>

Closed on October 3, 2017, 7:21pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.