# Logstash profile

**URL:** <https://discuss.elastic.co/t/logstash-profile/317934>\
**Category:** Logstash\
**Created:** [November 2, 2022, 3:26am UTC](https://discuss.elastic.co/t/logstash-profile/317934 "2022-11-02T03:26:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![GEHsu](https://avatars.discourse-cdn.com/v4/letter/g/c2a13f/32.png) [@GEHsu](https://discuss.elastic.co/u/GEHsu)\
**Post date:** [November 2, 2022, 3:26am UTC](https://discuss.elastic.co/t/logstash-profile/317934/1 "2022-11-02T03:26:51Z")

</div>

System is Ubuntu  
Logstash version 7.17

The current idea is to collect logs (via syslog-514Port) from different servers or network devices  
Logstash will then send the log cut to Elasticsearch  
I have successfully received logs and sent them to Elasticsearch

But I want to use conf to separate devices from different sources  
For example, DHCP log will create a DHCP.conf which is the name of his Log representation and output index

I tried forwarding with ufw first  
Convert 2 different source host 514 ports to specific ports  
then separate conf  
Also successfully delivered to Elasticsearch to build 2 indexes  
But the content is not separated

Is there any other way to solve it?  
Because the sources are different devices. Therefore, the log segmentation method is also different.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 2, 2022, 8:59am UTC](https://discuss.elastic.co/t/logstash-profile/317934/2 "2022-11-02T08:59:46Z")

</div>

AFAIK you cannot have multiple configuration on the same port. When you set a port number LS will run an instance with a listener on that port.

Options:  
a) One single.conf with few IFs which will handle cases of different sources. Always in a message there in a unique field to distinguish the source. Input must be the same, output will be again with IFs.  
b) Multiple ports for every source, for instance 514-DHCP, 515-firewall,...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2022, 9:00am UTC](https://discuss.elastic.co/t/logstash-profile/317934/3 "2022-11-30T09:00:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.