Logstash: parsing snmp traps ( continue...)

Hello all,

I would like to share my solution with my problem parsing traps.

I my problem is described in this topic: https://discuss.elastic.co/t/logstash-parsing-snmp-traps/103208.

The solution was :

  • List item

Change the filter:

filter {
mutate {
replace => { "message" => %{SNMPv2-SMI::enterprises.} : "EVENT_NAME:%{SNMPv2-SMI::enterprises.} MESSAGE:%{SNMPv2-SMI::enterprises.} NODE:%{SNMPv2-SMI::enterprises.} ENTITY_NAME:%{SNMPv2-SMI::enterprises.} " }

  • Change the output file:

if [SNMPv2-SMI::enterprises.] =="ERROR" {
file {
path => "/mydirectory/logstash/snmp.log"
codec => line { format=> "ERROR: %{message}"}

Thanks a lot for your help.

Best regards,

1 Like

Can't mark the original message as a solution. Doing it here.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.