---
title: Nmap codec plugin
description: Plugin version: v0.0.22 (Other versions), Released on: 2022-11-16, Changelog. For questions about the plugin, open a topic in the Discuss forums. For...
url: https://www.elastic.co/docs/reference/logstash/plugins/plugins-codecs-nmap
products:
  - Logstash
applies_to:
  - Elastic Stack: Generally available
---

# Nmap codec plugin
- Plugin version: v0.0.22 ([Other versions](https://www.elastic.co/docs/reference/logstash/versioned-plugins/codec-nmap-index))
- Released on: 2022-11-16
- [Changelog](https://github.com/logstash-plugins/logstash-codec-nmap/blob/v0.0.22/CHANGELOG.md)


## Getting help

For questions about the plugin, open a topic in the [Discuss](http://discuss.elastic.co) forums. For bugs or feature requests, open an issue in [Github](https://github.com/logstash-plugins/logstash-codec-nmap). For the list of Elastic supported plugins, please consult the [Elastic Support Matrix](https://www.elastic.co/support/matrix#matrix_logstash_plugins).

## Description

This codec is used to parse [nmap](https://nmap.org/) output data which is serialized in XML format. Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. For more information on nmap, see .
This codec can only be used for decoding data.
Event types are listed below
`nmap_scan_metadata`: An object containing top level information about the scan, including how many hosts were up, and how many were down. Useful for the case where you need to check if a DNS based hostname does not resolve, where both those numbers will be zero. `nmap_host`: One event is created per host. The full data covering an individual host, including open ports and traceroute information as a nested structure. `nmap_port`: One event is created per host/port. This duplicates data already in `nmap_host`: This was put in for the case where you want to model ports as separate documents in Elasticsearch (which Kibana prefers). `nmap_traceroute_link`: One of these is output per traceroute *connection*, with a `from` and a `to` object describing each hop. Note that traceroute hop data is not always correct due to the fact that each tracing ICMP packet may take a different route. Also very useful for Kibana visualizations.

## Nmap Codec Configuration Options


| Setting                                                               | Input type                                                      | Required |
|-----------------------------------------------------------------------|-----------------------------------------------------------------|----------|
| [`emit_hosts`](#plugins-codecs-nmap-emit_hosts)                       | [boolean](/docs/reference/logstash/plugins/value-types#boolean) | No       |
| [`emit_ports`](#plugins-codecs-nmap-emit_ports)                       | [boolean](/docs/reference/logstash/plugins/value-types#boolean) | No       |
| [`emit_scan_metadata`](#plugins-codecs-nmap-emit_scan_metadata)       | [boolean](/docs/reference/logstash/plugins/value-types#boolean) | No       |
| [`emit_traceroute_links`](#plugins-codecs-nmap-emit_traceroute_links) | [boolean](/docs/reference/logstash/plugins/value-types#boolean) | No       |


### `emit_hosts`

- Value type is [boolean](/docs/reference/logstash/plugins/value-types#boolean)
- Default value is `true`

Emit all host data as a nested document (including ports + traceroutes) with the type *nmap_fullscan*

### `emit_ports`

- Value type is [boolean](/docs/reference/logstash/plugins/value-types#boolean)
- Default value is `true`

Emit each port as a separate document with type *nmap_port*

### `emit_scan_metadata`

- Value type is [boolean](/docs/reference/logstash/plugins/value-types#boolean)
- Default value is `true`

Emit scan metadata

### `emit_traceroute_links`

- Value type is [boolean](/docs/reference/logstash/plugins/value-types#boolean)
- Default value is `true`

Emit each hop_tuple of the traceroute with type *nmap_traceroute_link*