Hello, I have an ELK server currently taking NetFlow traffic
from a single host and sending this to a custom index name (logstash_netflow-*)
etc and I’m now wanting to take syslogs on UDP port 5000. Currently NetFlow is
coming in on UDP port 9995 which works well.
What I’m wanting to do is be able to set an IF statement in
the output config so it will only take them from NetFlow and syslog only.
Is it possible to set the IF statement on maybe the netflow [codec]
directive and the syslog [type]? This is how I’m wanting to differentiate