# Receiving Multicast syslog data

**URL:** <https://discuss.elastic.co/t/receiving-multicast-syslog-data/39582>\
**Category:** Logstash\
**Created:** [January 19, 2016, 6:42pm UTC](https://discuss.elastic.co/t/receiving-multicast-syslog-data/39582 "2016-01-19T18:42:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wblair](https://avatars.discourse-cdn.com/v4/letter/w/c0e974/32.png) [@wblair](https://discuss.elastic.co/u/wblair)\
**Post date:** [January 19, 2016, 6:42pm UTC](https://discuss.elastic.co/t/receiving-multicast-syslog-data/39582/1 "2016-01-19T18:42:06Z")

</div>

I am having trouble trying to receive syslog data that is being sent to a multicast address.

Current setup is this  
Ubuntu PC with rsyslogd configured to send syslog data to a multicast address  
_._ @239.4.4.4:9211  
note that if i use a unicast address all works well with the standard syslog input  
_._ @192.168.0.100:9211

I can verify with wireshark that the machine with logstash running on it is receiving the multicast traffic however I cannot determine a setup for logstash that will allow ingestion of this multicast traffic.

Has anyone run into something similar or been able to configure an input to receive multicast traffic?

thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:15am UTC](https://discuss.elastic.co/t/receiving-multicast-syslog-data/39582/2 "2017-07-06T05:15:11Z")

</div>

Closed on July 6, 2017, 5:15am UTC