# Send logs from secondary ip

**URL:** <https://discuss.elastic.co/t/send-logs-from-secondary-ip/119142>\
**Category:** Logstash\
**Created:** [February 8, 2018, 11:52pm UTC](https://discuss.elastic.co/t/send-logs-from-secondary-ip/119142 "2018-02-08T23:52:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Geezer](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Geezer](https://discuss.elastic.co/u/Geezer)\
**Post date:** [February 8, 2018, 11:52pm UTC](https://discuss.elastic.co/t/send-logs-from-secondary-ip/119142/1 "2018-02-08T23:52:07Z")

</div>

Hi,

I need to send syslogs to a collector from Logstash but have it come from the secondary IP of the Logstash host. How can I specify the source IP that the Logstash will use to send the logs?

I have tried using sourcehost in my output file, and using LD\_PRELOAD to bind logstash to a different IP, but it didn't work.

This is Logstash 6.2.1 on CentOS 7.

Thanks

---

<div class="post-metadata">

**Author:** ![Geezer](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Geezer](https://discuss.elastic.co/u/Geezer)\
**Post date:** [February 9, 2018, 7:34pm UTC](https://discuss.elastic.co/t/send-logs-from-secondary-ip/119142/2 "2018-02-09T19:34:16Z")

</div>

I did this with iptables. Changed it to tcp output too.

I write a mark to the packet being sent from packet beat, then match this in rules to change source address and rewrite the destination port:

1. find anything sent by packet beat based on port and mark it  
iptables -t raw -A OUTPUT -p tcp --dport 5041 -j MARK --set-mark 0x63

2. use mark to change destination port  
iptables -t nat -A OUTPUT -p tcp -m mark --mark 0x63 -j DNAT --to x.x.x.x:514

3. use mark to change source address  
iptables -t nat -A POSTROUTING -p tcp -m mark --mark 0x63 -j SNAT --to-source y.y.y.y

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2018, 7:34pm UTC](https://discuss.elastic.co/t/send-logs-from-secondary-ip/119142/3 "2018-03-09T19:34:56Z")

</div>

Closed on March 9, 2018, 7:34pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.