Can we configure logstash output to send snmp trap?

Elastic Stack Logstash
1

can we configure logstash output to send snmp trap ?

1 Like
2

No you cannot.

I'd recommend the docs as the best place to look for these sorts of questions :slight_smile:

3

can we configure logstash output to send a snmp trap using a udp output?
why do i store in %{message} this string:

#<SNMP::SNMPv2_Trap:0x33dc757a @request_id=2089755128, @error_index=0, @error_status=0, @source_ip="***********", @varbind_list=[#<SNMP::VarBind:0x1004c3e7 @name=[1.3.6.1.2.1.1.3.0], @value=#<SNMP::TimeTicks:0x4a338a28 @value=975593717>>, #<SNMP::VarBind:0x1a1451b1 @name=[1.3.6.1.6.3.1.1.4.1.0], @value=[1.3.6.1.4.1.25461.2.1.3.2.0.2]>, #<SNMP::VarBind:0x4e536f77 @name=[1.3.6.1.4.1.25461.2.1.3.1.2], @value="2017/05/10 13:17:21">, #<SNMP::VarBind:0x787e86a1 @name=[1.3.6.1.4.1.25461.2.1.3.1.3], @value="001606005610">, #<SNMP::VarBind:0x2eca214c @name=[1.3.6.1.4.1.25461.2.1.3.1.4], @value="CONFIG">, #<SNMP::VarBind:0x16eb74fd @name=[1.3.6.1.4.1.25461.2.1.3.1.5], @value="0">, #<SNMP::VarBind:0x43168980 @name=[1.3.6.1.4.1.25461.2.1.3.1.7], @value="">, #<SNMP::VarBind:0x4fd154cd @name=[1.3.6.1.4.1.25461.2.1.3.1.8], @value="3038">, #<SNMP::VarBind:0x30eedc3a @name=[1.3.6.1.4.1.25461.2.1.3.1.9], @value="0x0">, #<SNMP::VarBind:0x7def1a46 @name=[1.3.6.1.4.1.25461.2.1.3.1.6], @value="***********">, #<SNMP::VarBind:0xac2d6f2 @name=[1.3.6.1.4.1.25461.2.1.3.1.150], @value="edit">, #<SNMP::VarBind:0x4f708c5b @name=[1.3.6.1.4.1.25461.2.1.3.1.151], @value="admin">, #<SNMP::VarBind:0x9b98683 @name=[1.3.6.1.4.1.25461.2.1.3.1.152], @value="Web">, #<SNMP::VarBind:0xc0180d8 @name=[1.3.6.1.4.1.25461.2.1.3.1.153], @value="Succeeded">, #<SNMP::VarBind:0x10e8b2ec @name=[1.3.6.1.4.1.25461.2.1.3.1.154], @value=" config shared log-settings config">]>

with this snmp input (capture with tcpdump):

13:17:21.662510 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 472)
    ***********.38175 > ***********.snmptrap: [udp sum ok]  { SNMPv2c C=*********** { V2Trap(425) R=2089755128  system.sysUpTime.0=975593717 S:1.1.4.1.0=E:25461.2.1.3.2.0.2 E:25461.2.1.3.1.2="2017/05/10 13:17:21" E:25461.2.1.3.1.3="001606005610" E:25461.2.1.3.1.4="CONFIG" E:25461.2.1.3.1.5="0" E:25461.2.1.3.1.7="" E:25461.2.1.3.1.8="3038" E:25461.2.1.3.1.9="0x0" E:25461.2.1.3.1.6="10.1.3.80" E:25461.2.1.3.1.150="edit" E:25461.2.1.3.1.151="admin" E:25461.2.1.3.1.152="Web" E:25461.2.1.3.1.153="Succeeded" E:25461.2.1.3.1.154=" config shared log-settings config" } }
E.....@.@.v... ... .........0........***********......|.!.......0...0...+.......C.:&`.0..
+......u.......3***********0...+......u........edit0...+......u........admin0...+......u........Web0...+......u.......    Succeeded04..+......u......." config shared log-settings config

i would like obtain this with a snmp input, not udp input without community:

> { SNMPv2c C=*********** { V2Trap(425) R=2089755128 system.sysUpTime.0=975593717 S:1.1.4.1.0=E:25461.2.1.3.2.0.2 E:25461.2.1.3.1.2="2017/05/10 13:17:21" E:25461.2.1.3.1.3="001606005610" E:25461.2.1.3.1.4="CONFIG" E:25461.2.1.3.1.5="0" E:25461.2.1.3.1.7="" E:25461.2.1.3.1.8="3038" E:25461.2.1.3.1.9="0x0" E:25461.2.1.3.1.6="10.1.3.80" E:25461.2.1.3.1.150="edit" E:25461.2.1.3.1.151="admin" E:25461.2.1.3.1.152="Web" E:25461.2.1.3.1.153="Succeeded" E:25461.2.1.3.1.154=" config shared log-settings config" } }