# Output NetFlow and Syslog to Elasticsearch

**URL:** <https://discuss.elastic.co/t/output-netflow-and-syslog-to-elasticsearch/29046>\
**Category:** Logstash\
**Created:** [September 10, 2015, 3:42pm UTC](https://discuss.elastic.co/t/output-netflow-and-syslog-to-elasticsearch/29046 "2015-09-10T15:42:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ben19](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ben19/32/3745_2.png) [@Ben19](https://discuss.elastic.co/u/Ben19)\
**Post date:** [September 10, 2015, 3:42pm UTC](https://discuss.elastic.co/t/output-netflow-and-syslog-to-elasticsearch/29046/1 "2015-09-10T15:42:46Z")

</div>

Hello, I have an ELK server currently taking NetFlow traffic  
from a single host and sending this to a custom index name (logstash\_netflow-\*)  
etc and I’m now wanting to take syslogs on UDP port 5000. Currently NetFlow is  
coming in on UDP port 9995 which works well.

What I’m wanting to do is be able to set an IF statement in  
the output config so it will only take them from NetFlow and syslog only.

Is it possible to set the IF statement on maybe the netflow [codec]  
directive and the syslog [type]? This is how I’m wanting to differentiate  
inbound traffic.

Thanks

---

<div class="post-metadata">

**Author:** ![Ben19](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ben19/32/3745_2.png) [@Ben19](https://discuss.elastic.co/u/Ben19)\
**Post date:** [September 10, 2015, 4:09pm UTC](https://discuss.elastic.co/t/output-netflow-and-syslog-to-elasticsearch/29046/2 "2015-09-10T16:09:08Z")

</div>

I’ll add some more details, this server is taking syslogs  
and NetFlow on alternate ports just fine. What I’m wanting to do is differentiate  
between NetFlow and syslog in the output config by using a different IF  
statement rather than (if ( [host] =~ /192.168.1.254/ ) {) in the below  
.conf file, because I’d rather not have to specify the host each time I want to  
add a new NetFlow device:

```
output {

stdout {
codec => rubydebug }

    if ( [host] =~ /192\.168\.1\.254/ ) {

      elasticsearch {

        index =>
"logstash_netflow5-%{+YYYY.MM.dd}"

        host => "localhost"

      }

    } else {

      elasticsearch {

        index =>
"logstash-%{+YYYY.MM.dd}"

        host => "localhost"

      }

    }

  }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 10, 2015, 7:32pm UTC](https://discuss.elastic.co/t/output-netflow-and-syslog-to-elasticsearch/29046/3 "2015-09-10T19:32:50Z")

</div>

> Is it possible to set the IF statement on maybe the netflow [codec] directive and the syslog [type]? This is how I’m wanting to differentiate inbound traffic.

Sure. You can place conditions on any field or combination of fields.

```
if [type] == "netflow" {
  ...
}

```

---

<div class="post-metadata">

**Author:** ![Ben19](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ben19/32/3745_2.png) [@Ben19](https://discuss.elastic.co/u/Ben19)\
**Post date:** [September 11, 2015, 10:24am UTC](https://discuss.elastic.co/t/output-netflow-and-syslog-to-elasticsearch/29046/4 "2015-09-11T10:24:17Z")

</div>

> [@Ben19](#):
>
> if ( [host] =~ /192.168.1.254/ ) {

Thanks, this worked and I just needed to add in the “type  
=\> netflow” directive into my input .conf too.

Thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/output-netflow-and-syslog-to-elasticsearch/29046/5 "2017-07-06T05:29:23Z")

</div>