Hello, everybody!
I wanted to try a logstash snmp plugin to get metrics from physical devices to migrate completely from zabbix to ELK. I spent very much time, but it doesn't work still...
I'm going to describe my env. so it is a test cluster, which has 3 elasticsearch+kibana nodes + 1 logstash node separately. elastic nodes have all the roles. I use 8.17.4 ELK stack version. logstash works on pipelines:
- "main", that redirects all requests from beats to specific pipelines
- "snmp", that i made couple days ago
so here is the configuration from /etc/logstash/pipelines.yml. i will include only "snmp" configuration
- pipeline.id: snmp
path.config: "/etc/logstash/conf.d/pipelines/snmp/*.conf"
next i have /etc/logstash/conf.d/pipelines/snmp/snmp.input.conf
input {
snmp {
hosts => [{ host => "udp:x.x.x.x/161" community => "public" version => "1" retries => 3 timeout => 5000 }
]
walk => ["1.3.6.1.4.1.318.1.1.13.3.3.1.2.2.7.0"]
interval => 60
ecs_compatibility => "disabled" #i don't know actually why i need this
add_field => { #to group different devices and set proper alerting
"cluster" => "test_cluster"
"environment" => "test"
"location" => "some_location"
}
}
}
output file lies also there and leads to elasticsearch
output {
elasticsearch {
hosts => ["https://y.y.y.1:9200","https://y.y.y.2:9200","https://y.y.y.3:9200"]
index => "snmp-%{[environment]}"
...
needed plugin is already installed from the box, but just in case i used next command to make you sure
/usr/share/logstash/bin/logstash-plugin list | grep snmp
logstash-integration-snmp
├── logstash-input-snmp
└── logstash-input-snmptrap
i used also these commands from the logstash server to check if there are any network or something restrictions
- snmpwalk -v1 -c public x.x.x.x 1.3.6.1.4.1.318.1.1.13.3.3.1.2.2.7.0
iso.3.6.1.4.1.318.1.1.13.3.3.1.2.2.7.0 = INTEGER: 283
- snmpget -v1 -c public x.x.x.x 1.3.6.1.4.1.318.1.1.13.3.3.1.2.2.7.0
iso.3.6.1.4.1.318.1.1.13.3.3.1.2.2.7.0 = INTEGER: 278
it is temperature, so its okay that it changes
so...everything looks like that it's configured right but it doesn't work, i have worked on many-many errors, but currently i get this
tail -f /var/log/logstash/logstash-plain.log
[2025-04-16T12:58:40,694][ERROR][org.logstash.snmp.SnmpClientRequestAggregator][snmp][85b9ab5811daf09d9189eec21728c97d800489c9706b4facc03142a664f79bdb] error invoking `walk` operation: error sending snmp walk request to target x.x.x.x/161: Request timed out., ignoring. {host=x.x.x.x/161, oids=[1.3.6.1.4.1.318.1.1.13.3.3.1.2.2.7.0]}
also there is no single example of working snmp module configuration in internet, and i hope mine will be first.
Please help, guys!