logstash. How to accept logs from different services for their further filtering?

Question

Asterisk

There is a logstash receiving server on port n. All syslog's are poured there from all clients, including Apache, asterisk, postfix.
The udp listener listens and accepts the syslog type, which seems logical, but how can I then separate the type of received logs in order to further parse through grok? Pseudoconfig as I want:

input { udp {port ... type = syslog}}
filter {
if type == ["syslog"]
....
if type == ["asterisk"]
....
if type == ["postfix"]
....
}

I saw for examples that for each type there is a separate port in the input, but I won’t open all ports in the firewall, because if I have, roughly, a thousand types of logs? There must be a more elegant solution...

Answer 1

stackoverflow.com/questions/18330541/how-to-handle...
figure it out?