# Port name lookup for Memcache packetbeat **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [February 1, 2017, 8:52pm UTC](https://discuss.elastic.co/t/port-name-lookup-for-memcache-packetbeat/73584 "2017-02-01T20:52:36Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![tarp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tarp/32/51884_2.png) [@tarp](https://discuss.elastic.co/u/tarp)\ **Post date:** [February 1, 2017, 8:52pm UTC](https://discuss.elastic.co/t/port-name-lookup-for-memcache-packetbeat/73584/1 "2017-02-01T20:52:36Z")
Hi, I use packetbeat to monitor our memcache instances. I have two linux boxes running multiple instances of memcache. For example I have the following instances defined like this. Port = 11211 == App1 11212 == App2 11213 == App3 I would like to figure out the best way to add the App1, App2 and App3 name to the event. In my environment I'm running 5.1.2 and my Packetbeat sends directly into ingest nodes. Can I modify a pipeline on the ingest node to add this App name? Thanks, Tim ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 2, 2017, 2:48am UTC](https://discuss.elastic.co/t/port-name-lookup-for-memcache-packetbeat/73584/2 "2017-02-02T02:48:43Z")
I think [https://www.elastic.co/guide/en/beats/packetbeat/current/using-environ-vars.html](https://www.elastic.co/guide/en/beats/packetbeat/current/using-environ-vars.html) would probably be what you are after. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [February 2, 2017, 1:05pm UTC](https://discuss.elastic.co/t/port-name-lookup-for-memcache-packetbeat/73584/3 "2017-02-02T13:05:38Z")
Unfortunately in packetbeat one can not configure a protocol analyzer of the same type multiple times (e.g. filebeat/metricbeat allows defining the same module type multiple times + support to configure additional metadata). In your case I think I would add a field via ingest pipeline. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 2, 2017, 1:05pm UTC](https://discuss.elastic.co/t/port-name-lookup-for-memcache-packetbeat/73584/4 "2017-03-02T13:05:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.