﻿---
title: Nmap codec plugin v0.0.21
description: Plugin version: v0.0.21, Released on: 2017-11-07, Changelog. For other versions, see the overview list. To learn more about Logstash, see the Logstash...
url: https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/vpr/v0-0-21-plugins-codecs-nmap
---

# Nmap codec plugin v0.0.21
- Plugin version: v0.0.21
- Released on: 2017-11-07
- [Changelog](https://github.com/logstash-plugins/logstash-codec-nmap/blob/v0.0.21/CHANGELOG.md)

For other versions, see the [overview list](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/vpr/codec-nmap-index).
To learn more about Logstash, see the [Logstash Reference](https://www.elastic.co/guide/en/logstash/current/index.html).

## Getting help

For questions about the plugin, open a topic in the [Discuss](http://discuss.elastic.co) forums. For bugs or feature requests, open an issue in [Github](https://github.com/logstash-plugins/logstash-codec-nmap). For the list of Elastic supported plugins, please consult the [Elastic Support Matrix](https://www.elastic.co/support/matrix#matrix_logstash_plugins).

## Description

This codec is used to parse [namp](https://nmap.org/) output data which is serialized in XML format. Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. For more information on nmap, see .
This codec can only be used for decoding data.
Event types are listed below
`nmap_scan_metadata`: An object containing top level information about the scan, including how many hosts were up, and how many were down. Useful for the case where you need to check if a DNS based hostname does not resolve, where both those numbers will be zero. `nmap_host`: One event is created per host. The full data covering an individual host, including open ports and traceroute information as a nested structure. `nmap_port`: One event is created per host/port. This duplicates data already in `nmap_host`: This was put in for the case where you want to model ports as separate documents in Elasticsearch (which Kibana prefers). `nmap_traceroute_link`: One of these is output per traceroute *connection*, with a `from` and a `to` object describing each hop. Note that traceroute hop data is not always correct due to the fact that each tracing ICMP packet may take a different route. Also very useful for Kibana visualizations.

## Nmap Codec Configuration Options


| Setting                                                                                              | Input type                                                                    | Required |
|------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------|----------|
| [`emit_hosts`](#v0.0.21-plugins-codecs-nmap-emit_hosts)`emit_hosts`                                  | [boolean](/elastic/logstash-docs-md/tree/main/lsr/value-types#boolean)boolean | No       |
| [`emit_ports`](#v0.0.21-plugins-codecs-nmap-emit_ports)`emit_ports`                                  | [boolean](/elastic/logstash-docs-md/tree/main/lsr/value-types#boolean)boolean | No       |
| [`emit_scan_metadata`](#v0.0.21-plugins-codecs-nmap-emit_scan_metadata)`emit_scan_metadata`          | [boolean](/elastic/logstash-docs-md/tree/main/lsr/value-types#boolean)boolean | No       |
| [`emit_traceroute_links`](#v0.0.21-plugins-codecs-nmap-emit_traceroute_links)`emit_traceroute_links` | [boolean](/elastic/logstash-docs-md/tree/main/lsr/value-types#boolean)boolean | No       |


### `emit_hosts`

- Value type is [boolean](/elastic/logstash-docs-md/tree/main/lsr/value-types#boolean)
- Default value is `true`

Emit all host data as a nested document (including ports + traceroutes) with the type *nmap_fullscan*

### `emit_ports`

- Value type is [boolean](/elastic/logstash-docs-md/tree/main/lsr/value-types#boolean)
- Default value is `true`

Emit each port as a separate document with type *nmap_port*

### `emit_scan_metadata`

- Value type is [boolean](/elastic/logstash-docs-md/tree/main/lsr/value-types#boolean)
- Default value is `true`

Emit scan metadata

### `emit_traceroute_links`

- Value type is [boolean](/elastic/logstash-docs-md/tree/main/lsr/value-types#boolean)
- Default value is `true`

Emit each hop_tuple of the traceroute with type *nmap_traceroute_link*