PEEID=$(sudo pgrep -u root ) && for device in `sudo lsof -anP -i -u root | grep ':9814' | awk '{print $6}'` ; do echo "${device} time" ; sudo find /proc/1/fd -lname "socket:\[${device}\]" -printf %t\\n 2> /dev/null  ; echo  ;  done 

This questions was helpful to me, but I found usinglsofinstead ofnetstat

For a process${APP}run by user${USER}, the following returns all the open sockets to the IP address ${IP}:

PEEID=$(sudo pgrep -u ${USER} ${APP}) && for i in `sudo lsof -anP -i -u logstash | grep ${IP} | awk '{print $6}'` ; do echo "${device} time" ; sudo find /proc/${PEEID}/fd -lname "socket:\[${device}\]" -printf %t 2> /dev/null  ; echo  ;  done
 

Thelsofcontains thePIDtoo, but I am not sure how to get it and the device number.

This was tested on Amazon Linux.