# Logstash - Collecting SNMP data from network devices **URL:** \ **Category:** Logstash\ **Created:** [December 22, 2022, 7:20am UTC](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814 "2022-12-22T07:20:31Z")\ **Posts on this page:** 7\ **Page:** 2
**Author:** ![hendry.lim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hendry.lim/32/71328_2.png) [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\ **Post date:** [December 26, 2022, 12:52pm UTC](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814/23 "2022-12-26T12:52:19Z")
> we confirm the device are connected properly with our ELK cluster server where we install the logstash. Would you be able to elaborate on this? How did you test/verify this exactly? I hope you are not confused between `snmp` and `snmptrap` input. `snmp` input is used to connect Logstash to network devices, i.e. the network connection direction is outbound from Logstash and inbound into the network devices. While `snmptrap` is the reverse of the `snmp` input. From your statement, I presume you are expecting connection **from** the network devices **into** Logstash, not the other way around. ---
**Author:** ![muhammad-murad.nagoo](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@muhammad-murad.nagoo](https://discuss.elastic.co/u/muhammad-murad.nagoo)\ **Post date:** [December 27, 2022, 9:20am UTC](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814/24 "2022-12-27T09:20:45Z")
Yes, we are expecting the snmp logs from devices to LS. The flow should network devices ---\> Logstash ---\> Elastic Cloud. The config as below : input { snmp { # The SNMP host to connect to hosts =\> [{host =\> "udp:10.1.133.250/161" community =\> "Private"}] get =\> ["1.3.6.1.2.1.1.1.0", "1.3.6.1.2.1.1.3.0", "1.3.6.1.2.1.1.5.0"] } } output { elasticsearch { # The Elasticsearch host to connect to cloud\_id =\> ["dXMtY2VudHJhbDEuZ2NwLmNsb3VkLmVzLmlvOjQ0MyQyZDNjMjJkYWEzZWQ0ZTczYmM3OGZjOWVlNzE3ZDNiNiQ4XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=="] cloud\_auth =\> "elastic:R618RKOpsoXXXXXXXXXXXXXXXXl" ``` # The index to use for the collected data index => "snmp" ``` } } Its means my config is wrong? the input should be the output and same for output ? For clarifying the connection, we are using the Frameflow to check the connection. ![Frameflow](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0aea9a3d8fe8b1bf9fda8a1181e8f823c4cca0c6.png) Appreciate your insight on this. ---
**Author:** ![hendry.lim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hendry.lim/32/71328_2.png) [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\ **Post date:** [December 28, 2022, 5:12am UTC](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814/25 "2022-12-28T05:12:37Z")
Did you run FrameFlow on the same host where you run Logstash? I noticed the `community` is not `public` on the FrameFlow screen. I would also suggest to try to run `snmpget` or `snmpwalk` tool on Windows to test the connectivity. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [December 28, 2022, 6:23am UTC](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814/26 "2022-12-28T06:23:14Z")
You are on good path.You will need MIBs and replace `get => ["1.3.6.1.2.1.1.1.0", "1.3.6.1.2.1.1.3.0", "1.3.6.1.2.1.1.5.0"]` with your values which will FrameFlow show up. > Use the `get` option to query for scalar values for the given OID(s). One or more OID(s) are specified as an array of strings of OID(s). ---
**Author:** ![muhammad-murad.nagoo](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@muhammad-murad.nagoo](https://discuss.elastic.co/u/muhammad-murad.nagoo)\ **Post date:** [January 3, 2023, 9:40am UTC](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814/27 "2023-01-03T09:40:20Z")
Yes Sir, the same host. I tried public, then private then the value i found in the frameflow apps Sure, will run and update the result ---
**Author:** ![muhammad-murad.nagoo](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@muhammad-murad.nagoo](https://discuss.elastic.co/u/muhammad-murad.nagoo)\ **Post date:** [January 3, 2023, 9:41am UTC](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814/28 "2023-01-03T09:41:33Z")
The OID's are same. Look like its the default value. Will add MIB's and try. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 31, 2023, 9:41am UTC](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814/29 "2023-01-31T09:41:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814.md?page=1)