# Multiple Syslog Sources Configuration on Single Elastic Agent Port, port 514 **URL:** \ **Category:** Elastic Agent\ **Created:** [February 26, 2025, 10:02pm UTC](https://discuss.elastic.co/t/multiple-syslog-sources-configuration-on-single-elastic-agent-port-port-514/375109 "2025-02-26T22:02:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![IsaacZhu](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@IsaacZhu](https://discuss.elastic.co/u/IsaacZhu)\ **Post date:** [February 26, 2025, 10:02pm UTC](https://discuss.elastic.co/t/multiple-syslog-sources-configuration-on-single-elastic-agent-port-port-514/375109/1 "2025-02-26T22:02:02Z")
Current Setup: - Elastic Agent collecting syslog messages from: - Aruba access points and switches (Custom UDP integration) - F5 VPN (Custom UDP integration) - Fortigate firewalls (Fortigate Syslog integration) - All configured to use port 514 - Single Elastic Agent instance Issue: All syslog messages are being processed only by the Fortigate Syslog integration, while the custom UDP integrations for Aruba and F5 are being bypassed completely. Question: What's the recommended approach to configure multiple syslog sources (Aruba, F5, Fortigate) on a single Elastic Agent using the same port (514)? Looking for a solution that doesn't require setting up different ports for each system. Additional Context: - Need to maintain standard syslog port (514) - Prefer to keep single agent configuration - Require proper message routing to respective integrations ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 26, 2025, 10:31pm UTC](https://discuss.elastic.co/t/multiple-syslog-sources-configuration-on-single-elastic-agent-port-port-514/375109/2 "2025-02-26T22:31:01Z")
Hello and welcome, You cannot have multiple integrations listening on the same port, each integration is a different process and you cannot bind different processes to the same port. It is required to use a different port for each integration. If you cannot change the port and need to use 514 you need something to reroute the events to the correct integration. Depending on the version of the stack you are, there is a new integration called [Syslog Router](https://www.elastic.co/guide/en/integrations/current/syslog_router.html) that can do that, it has some pre-configured patterns to reroute to the correct integration, but you can also add extra patterns. This integration requires version 8.14.3 or higher and it is still in beta. You can also do this reroute using `rsyslog`, in this case you would need to configure each integration with a different internal port and in rsyslog you could direct the logs to each integration based on the source or some other logic. ---
**Author:** ![IsaacZhu](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@IsaacZhu](https://discuss.elastic.co/u/IsaacZhu)\ **Post date:** [February 26, 2025, 11:33pm UTC](https://discuss.elastic.co/t/multiple-syslog-sources-configuration-on-single-elastic-agent-port-port-514/375109/3 "2025-02-26T23:33:35Z")
Thanks Leandro, that's very helpful! I'm wondering if I have these integrations on different agent instances but still with the same port, so essentially I'm gonna switch to a multi-agent setup, will it solve this problem? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 27, 2025, 12:24am UTC](https://discuss.elastic.co/t/multiple-syslog-sources-configuration-on-single-elastic-agent-port-port-514/375109/4 "2025-02-27T00:24:48Z")
> [@IsaacZhu](#): > > I'm wondering if I have these integrations on different agent instances but still with the same port, so essentially I'm gonna switch to a multi-agent setup, will it solve this problem? If by different instances you mean completely different machines/VMs, then you will have no issues as the agents would be running on different places. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 27, 2025, 12:30am UTC](https://discuss.elastic.co/t/multiple-syslog-sources-configuration-on-single-elastic-agent-port-port-514/375109/5 "2025-02-27T00:30:59Z")
Also, are you using Fleet Managed or Standalone agents? If you are using Fleet Managed, you would need one policy per agent. ---
**Author:** ![IsaacZhu](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@IsaacZhu](https://discuss.elastic.co/u/IsaacZhu)\ **Post date:** [February 27, 2025, 12:47am UTC](https://discuss.elastic.co/t/multiple-syslog-sources-configuration-on-single-elastic-agent-port-port-514/375109/6 "2025-02-27T00:47:01Z")
Yes, that's great to hear. Exactly, I mean by different VMs. ---
**Author:** ![IsaacZhu](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@IsaacZhu](https://discuss.elastic.co/u/IsaacZhu)\ **Post date:** [February 27, 2025, 12:47am UTC](https://discuss.elastic.co/t/multiple-syslog-sources-configuration-on-single-elastic-agent-port-port-514/375109/7 "2025-02-27T00:47:45Z")
It's standalone agents