Multiple data sources over same port

[IsaacKr]

We are ingesting data from multiple data sources over port 514 and using Logstash to ship them out to multiple destinations. Is there a way to tag ingested data based on source IP so that it can be forwarded to the correct destination?

Something like

input {
   udp {
      port => 514
      source_port => x.x.x.x
      tags => "cef"
   }
   udp {
      port => 514
      source_port => y.y.y.y.y
      tags => "syslog"
   }
}

Where the source_port would be the IP of the data source.

[leandrojmp (Leandro Pereira)]

It depends on how your message looks like, you can use some string from your message to add tags in the filter block.

filter {
    if "something" in [message] {
        mutate {
            add_tag => ["tag"]
        }
    }
}

Or you can also parse your message and use a similar condition with the value of specific field, but is not possible to do what you want in the input, there is nothing like that config.

[Badger]

The udp input adds the source ip of the the message to the event, so you can add tags conditional upon that. It does not include the source port.