Logstash snmp output

Elastic Stack Logstash
1

i am successfully SNMP polling the network device. But fields in output are OID. how do i get proper fields. Below is example output.

++++++++++++++++++++++++++++++++++++++++
"host" => "x.x.x.x",
"iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.10101" => "Gi1/0/1",
"@version" => "1",
"type" => "snmpv2",
"@timestamp" => 2020-05-20T08:01:42.315Z,
"tags" => [
[0] "LOGSTASH",
[1] "INHY",
[2] "SNMPv2"
]
+++++++++++++++++++++++++++++++++++++++++++++++

2

What do you think is "proper"?

3

field names. like interface, cpu utilization, memory free, memory used, etc, instead of OID

4

If you want to trim iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.10101 down to just ifName you could use something similar to this. Obviously you would have to change the if and add a second gsub to strip the leading elements of the name.

5

Below is stdout. Is tehere any another option other than conversion like you told.

"iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCOutOctets.3" => 1005966852480,
                                                                                "@version" => "1",
                         "iso.org.dod.internet.private.enterprises.12356.101.12.2.1.4.2.1" => "error: no such instance currently exists at this OID",
                       "iso.org.dod.internet.private.enterprises.12356.101.12.2.2.1.6.2.1" => "103.44.2.78",
          "iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.4" => "act",
                "iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.3" => 944505216,
                                                                                "hostsnmp" => "10.252.255.1",
     "iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.4" => 445503968,
                       "iso.org.dod.internet.private.enterprises.12356.101.12.2.2.1.4.2.1" => "155.94.153.1",
                                                                                    "type" => "snmpv2"
}
{
                 "iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifInOctets.3" => 4268568351,
                       "iso.org.dod.internet.private.enterprises.12356.101.12.2.2.1.2.2.1" => "inhy-to-usla-1",
          "iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.3" => "pioneer",
           "iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.3" => "port1",
    "iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCOutOctets.4" => 39305728,
      "iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHighSpeed.3" => 1000,
     "iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.3" => 1206859411231,
                                                                              "@timestamp" => 2020-05-27T08:19:28.719Z,
                                                                                    "tags" => [
        [0] "ISSQLOGSTASH",
        [1] "INHY",
        [2] "SNMPv2"
    ],
    "iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCOutOctets.3" => 1005966998838,
                                                                                "@version" => "1",
                         "iso.org.dod.internet.private.enterprises.12356.101.12.2.1.4.2.1" => "error: no such instance currently exists at this OID",
                       "iso.org.dod.internet.private.enterprises.12356.101.12.2.2.1.6.2.1" => "103.44.2.78",
          "iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifAlias.4" => "act",
                "iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOutOctets.3" => 944651574,
                                                                                "hostsnmp" => "10.252.255.1",
     "iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.4" => 445504032,
                       "iso.org.dod.internet.private.enterprises.12356.101.12.2.2.1.4.2.1" => "155.94.153.1",
                                                                                    "type" => "snmpv2"

``````````````````````````````
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.