How to check logstash have listen snmptrap?

Elastic Stack Logstash
1

I am a new to lostash and elastichsearch. I want to collection logs of network devices by snmptrap. I have a problem with logstash.

+snmptrapd.conf
authCommunity log,net public
forward default localhost:1062

+logstash-snmptrap.conf

input {
snmptrap {
community => "public"
port => 1062
type => "snmp_trap"
}
}

output {
if [type] == "snmp_trap" {
file {
codec => "rubydebug"
flush_interval => 1
path => "/tmp/logstash-snmptrap.log"
}
}
}

Is there any issue with the configuration ? Netstat output as follows,
udp 0 0 0.0.0.0:162 0.0.0.0:*
udp6 0 0 :::1062 :::* 10771/java

I didn't get any error msg when i execute the command as follows,
root@pc:~# /opt/logstash/bin/logstash -f /etc/logstash/conf.d/logstash- snmptrap.conf -v --debug --verbose

Settings: Default filter workers: 1
It's a Trap! {:Port=>1062, :Community=>["public"], :Host=>"0.0.0.0", :level=>:info}
Using mapping template from {:path=>nil, :level=>:info}
Attempting to install template {:manage_template=>{"template"=>"logstash-", "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"default"=>{"_all"=>{"enabled"=>true, "omit_norms"=>true}, "dynamic_templates"=>[{"message_field"=>{"match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"string", "index"=>"analyzed", "omit_norms"=>true, "fielddata"=>{"format"=>"disabled"}}}}, {"string_fields"=>{"match"=>"", "match_mapping_type"=>"string", "mapping"=>{"type"=>"string", "index"=>"analyzed", "omit_norms"=>true, "fielddata"=>{"format"=>"disabled"}, "fields"=>{"raw"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true, "ignore_above"=>256}}}}}, {"float_fields"=>{"match"=>"", "match_mapping_type"=>"float", "mapping"=>{"type"=>"float", "doc_values"=>true}}}, {"double_fields"=>{"match"=>"", "match_mapping_type"=>"double", "mapping"=>{"type"=>"double", "doc_values"=>true}}}, {"byte_fields"=>{"match"=>"", "match_mapping_type"=>"byte", "mapping"=>{"type"=>"byte", "doc_values"=>true}}}, {"short_fields"=>{"match"=>"", "match_mapping_type"=>"short", "mapping"=>{"type"=>"short", "doc_values"=>true}}}, {"integer_fields"=>{"match"=>"", "match_mapping_type"=>"integer", "mapping"=>{"type"=>"integer", "doc_values"=>true}}}, {"long_fields"=>{"match"=>"", "match_mapping_type"=>"long", "mapping"=>{"type"=>"long", "doc_values"=>true}}}, {"date_fields"=>{"match"=>"", "match_mapping_type"=>"date", "mapping"=>{"type"=>"date", "doc_values"=>true}}}, {"geo_point_fields"=>{"match"=>"", "match_mapping_type"=>"geo_point", "mapping"=>{"type"=>"geo_point", "doc_values"=>true}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "doc_values"=>true}, "@version"=>{"type"=>"string", "index"=>"not_analyzed", "doc_values"=>true}, "geoip"=>{"type"=>"object", "dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip", "doc_values"=>true}, "location"=>{"type"=>"geo_point", "doc_values"=>true}, "latitude"=>{"type"=>"float", "doc_values"=>true}, "longitude"=>{"type"=>"float", "doc_values"=>true}}}}}}}, :level=>:info}
New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["localhost"], :level=>:info}
Pipeline started {:level=>:info}
Logstash startup completed

but I can't find the file "/tmp/logstash-snmptrap.log" , what's wrong with my logstash config ?

2

It seems you're not running the configuration you think you're running. According to the log you have an elasticsearch output in your configuration.

3

Is it wrong with my config ?

4

The configuration you posted looks correct, but the log from what you ran indicates a different configuration. It clearly shows that you had an elasticsearch output but the configuration you posted didn't contain any elasticsearch outputs.

5

I don't know if you have copy your command line (well I think so) but :

root@pc:~# /opt/logstash/bin/logstash -f /etc/logstash/conf.d/logstash- snmptrap.conf -v --debug --verbose

contains a space between "logstash-" and "snmptrap.conf", maybe the mistake ?