# Show udp source port

**URL:** <https://discuss.elastic.co/t/show-udp-source-port/274539>\
**Category:** Logstash\
**Created:** [May 31, 2021, 5:03pm UTC](https://discuss.elastic.co/t/show-udp-source-port/274539 "2021-05-31T17:03:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Der](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@Alex\_Der](https://discuss.elastic.co/u/Alex_Der)\
**Post date:** [May 31, 2021, 5:03pm UTC](https://discuss.elastic.co/t/show-udp-source-port/274539/1 "2021-05-31T17:03:49Z")

</div>

I'm using Logstash to ingest the logs sent (via udp) by 5 different applications running on another machine.  
Each aplication sends its log to Logstash from a different port (e.g. application\_1 from port 1760, application\_2 from port 1761 etc). Their source code can not be modified.  
I would like to filter the logs via the source.port, but I don't understand how to make it visible in Logstash and ultimately in Kibana.  
Is there a way to find out the source port of the received log?

My Logstash conf file looks like this

```
input {
  udp {
    port => 10514
    type => udp
  }
}

filter {
 grok {
    match => { "message" => "%{GREEDYDATA:log_message}\s"}
  }
}

output {
  elasticsearch { hosts => ["server_ip:9200"]
    user => "elastic"
    password => "pass"
    index => "log-%{+YYYY.MM.dd}"
    }
  stdout { codec => rubydebug }
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 31, 2021, 5:49pm UTC](https://discuss.elastic.co/t/show-udp-source-port/274539/2 "2021-05-31T17:49:28Z")

</div>

> [@Alex\_Der](#):
>
> Is there a way to find out the source port of the received log?

Not using the udp input that ships with logstash. The [code](https://github.com/logstash-plugins/logstash-input-udp/blob/cc2dd3346aecc27f4e7d813f73dd4e8433b1014d/lib/logstash/inputs/udp.rb#L162) pulls the IP address out of the inet\_addr structure and adds that to the event, but does not do the same for the source port. You could trivially modify the input to do so and build it yourself.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2021, 5:49pm UTC](https://discuss.elastic.co/t/show-udp-source-port/274539/3 "2021-06-28T17:49:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.