# Separate device in logstash based on the destination port

**URL:** <https://discuss.elastic.co/t/separate-device-in-logstash-based-on-the-destination-port/308235>\
**Category:** Logstash\
**Created:** [June 27, 2022, 10:44am UTC](https://discuss.elastic.co/t/separate-device-in-logstash-based-on-the-destination-port/308235 "2022-06-27T10:44:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![abd\_sh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abd_sh/32/107615_2.png) [@abd\_sh](https://discuss.elastic.co/u/abd_sh)\
**Post date:** [June 27, 2022, 10:44am UTC](https://discuss.elastic.co/t/separate-device-in-logstash-based-on-the-destination-port/308235/1 "2022-06-27T10:44:02Z")

</div>

Hello,

i hope you are doing well.  
i am trying to separate device in logstash based on the destination port.  
i am using the below config file  
"input {  
udp { port =\> 5014}  
udp { port =\> 5015 }  
}

filter {  
if port == 5014 {  
grok {  
patterns\_dir =\> "/usr/share/logstash/grok\_patterns"  
match =\> {  
"message" =\> "%{TEST:test}\d+: \d\*.\d\*.\d\*.\d\*: %{SEQUENCE\_NUMBER:syslog\_sequence\_number}:\s+%{SYSLOGTIMESTAMP:syslog\_timestamp}:\s+%{GREEDYDATA:syslog\_message}"  
}  
add\_tag =\> ["itnc\_rs"]  
remove\_field =\> "test"  
remove\_field =\> "@version"  
remove\_field =\> "event.original"  
remove\_field =\> "port"  
#remove\_field =\> "@timestamp"  
}

```auto
}

```

}  
if port == 5015 {  
grok {  
patterns\_dir =\> "/usr/share/logstash/grok\_patterns"  
match =\> {  
"message" =\> "%{TEST:test}\d+: \d\*.\d\*.\d\*.\d\*: %{SEQUENCE\_NUMBER:syslog\_sequence\_number}:\s+%{SYSLOGTIMESTAMP:syslog\_timestamp}:\s+%{GREEDYDATA:syslog\_message}"  
}  
add\_tag =\> ["itnc\_wlc"]  
remove\_field =\> "test"  
remove\_field =\> "@version"  
remove\_field =\> "event.original"  
remove\_field =\> "port"  
#remove\_field =\> "@timestamp"  
}  
}

output {  
if port == 5014 {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
user =\> "bot\_it\_itnc\_rw"  
password =\> "xxxxxxx!"  
index =\> "it-itnc-rs-%{+YYYY.MM}"  
}  
}

if port == 5015 {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
user =\> "bot\_it\_itnc\_rw"  
password =\> "xxxxx"  
index =\> "it-itnc-wlc-%{+YYYY.MM}"  
}  
}  
}  
"

it is not working at all. i will be really thankful if you can take a look

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 25, 2022, 10:44am UTC](https://discuss.elastic.co/t/separate-device-in-logstash-based-on-the-destination-port/308235/2 "2022-07-25T10:44:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.