Avaya IP Office 500 R11 SMDR -> Logstash

Just wanted to share my configuration with the community after refining it for the better part of a week. Being new to the ELK stack it took a bit of time to understand how to get tcp flows into the platform. There was also a bit of a learning curve as some previous examples of how to do this were discussed years ago, and some bugs needed to be worked out as a result. The script consumes the csv lines that come in, maps them to their related field names, creates/caculates/populates a duration field in seconds, and then deletes the original CSV message before sending it on.

Hopefully this is helpful to someone else out there looking to log their SMDR data without having to purchase a call accounting software etc.

input {
    tcp {
        port => "5500"
    skip_empty_columns => true
    columns => ["Call Start","Connected Time","Ring Time","Caller","Direction","Called Number","Dialled Number","Account","Is Internal","Call ID","Continuation","Party1Device","Party1Name","Party2Device","Party2Name","Hold Time","Park Time","AuthValid","AuthCode","User Charged","Call Charge","Currency","Amt at Last User Change","Call Units","Units at Last User Chg","Cost per Unit","Mark Up","Ext Targeting Cause","Ext Targeter Id","Ext Targeted Number","Srv IP of caller extn","Unique call id for the caller extension","Server IP address of the called extension","Unique call id for the called extension","UTC time"]
    add_field => { "Duration" => 0 }
    convert => { "Duration" => "integer" }
  ruby {
    code => " h, m, s = event.get('Connected Time').split(':').map{|str| str.to_i};
             event.set('Duration', h*3600 + m*60 + s) "
    remove_field => [ "message" ]
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    manage_template => false
1 Like

Thanks a lot @Adrien_Carlyle. This was perfectly what I was looking for.
I just edited it so that it saves a copy of the data to a log file as well.

Only issue I am having, is generating the reports I need in Kabana.
Lets say for example I want to see a list of all external calls that were made for a month.
I tried creating a visual in a table to display that data but that wasn't working for me.

You have any idea on getting that done?

Unfortunately not yet. I was trying to make a graph than would show me the sum of durations rather than just the sum of call events per day/week and was hitting a wall.

I haven't circled back around to work through the learning curve on the reporting side but for now I can at least search for an event and filter. Will try to remember to post back here any relevant helpful things I figure out.

Ahh ok. So we're in the same boat.
Alright. If I learn anything as well, I'll share here.
Thanks again.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.