# Manage different type of logs with logstash

**URL:** <https://discuss.elastic.co/t/manage-different-type-of-logs-with-logstash/249964>\
**Category:** Logstash\
**Created:** [September 25, 2020, 10:48am UTC](https://discuss.elastic.co/t/manage-different-type-of-logs-with-logstash/249964 "2020-09-25T10:48:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Luca\_Padovan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_padovan/32/76223_2.png) [@Luca\_Padovan](https://discuss.elastic.co/u/Luca_Padovan)\
**Post date:** [September 25, 2020, 10:48am UTC](https://discuss.elastic.co/t/manage-different-type-of-logs-with-logstash/249964/1 "2020-09-25T10:48:02Z")

</div>

I'm trying to managing different type of logs with logstash, but i don't see them in kibana.  
logstash pipeline:

```auto
input {
	udp {
		port => 5000
		type => "heartbeat"
	}
	udp {
		port => 6000
		type => "startup_shutdown"
	}
}

filter {
	if [type] == "heartbeat" {
		grok {
				match => { "message" => "\[%{NUMBER:opcode:int},%{NUMBER:sender:int},%{NUMBER:alertbitmap:int},%{NUMBER:bat:float},%{NUMBER:ant:int},%{NUMBER:resbat:int},%{NUMBER:temp:float},%{NUMBER:presatm:int},%{NUMBER:umid:int},%{NUMBER:vertical:int},%{NUMBER:analog1:float},%{NUMBER:analog2:float},%{NUMBER:analog3:float},%{NUMBER:analog4:float},%{NUMBER:spostam:int},%{NUMBER:contporta1:int},%{NUMBER:contporta2:int},%{NUMBER:digital1:int},%{NUMBER:digital2:int},%{NUMBER:digital3:int},%{NUMBER:digital4:int},%{NUMBER:time:int}\]" }
		}
	} 
	if [type] == "startup_shutdown" {
		grok {
				match => { "message" => "\[%{NUMBER:opcode:int},%{NUMBER:sender:int},%{NUMBER:time:int}\]" }
		}
	}
}

output {
	elasticsearch {
		hosts => "elasticsearch:9200"
	}
}

```

How can I solve this problem? thanks in advance.

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [September 26, 2020, 3:04am UTC](https://discuss.elastic.co/t/manage-different-type-of-logs-with-logstash/249964/2 "2020-09-26T03:04:55Z")

</div>

You need to create a index pattern in Kibana, did you do that?

---

<div class="post-metadata">

**Author:** ![Luca\_Padovan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_padovan/32/76223_2.png) [@Luca\_Padovan](https://discuss.elastic.co/u/Luca_Padovan)\
**Post date:** [September 28, 2020, 7:15am UTC](https://discuss.elastic.co/t/manage-different-type-of-logs-with-logstash/249964/3 "2020-09-28T07:15:19Z")

</div>

Yes, I created a unique index pattern in kibana, but i don't see only the UDP messages coming from port 6000, but i see UDP messages from port 5000

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [September 28, 2020, 11:21am UTC](https://discuss.elastic.co/t/manage-different-type-of-logs-with-logstash/249964/4 "2020-09-28T11:21:54Z")

</div>

Check logstash and elasticsearch logs for errors

Check firewall rules on logstash, is UDP port 6000 listening and open?

Use tcpdump on the logstash host to ensure that udp 6000 events are arriving

---

<div class="post-metadata">

**Author:** ![Luca\_Padovan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_padovan/32/76223_2.png) [@Luca\_Padovan](https://discuss.elastic.co/u/Luca_Padovan)\
**Post date:** [September 28, 2020, 12:05pm UTC](https://discuss.elastic.co/t/manage-different-type-of-logs-with-logstash/249964/5 "2020-09-28T12:05:58Z")

</div>

port 6000 was closed, thanks a lot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 26, 2020, 12:06pm UTC](https://discuss.elastic.co/t/manage-different-type-of-logs-with-logstash/249964/6 "2020-10-26T12:06:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.