# Logstash SNMP plugin not polling all OIDs **URL:** \ **Category:** Logstash\ **Created:** [April 21, 2026, 8:44am UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975 "2026-04-21T08:44:55Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![tom.verbeek](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@tom.verbeek](https://discuss.elastic.co/u/tom.verbeek)\ **Post date:** [April 21, 2026, 8:44am UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975/1 "2026-04-21T08:44:55Z")
Hi, I'm setting up a logstash that has a snmp input plugin and an elasticsearch output. Everything works except 1 specific OID, I checked and the OID has data and it is available. I ca't figure out why he is not polling this 1 specific OID, google was no help. Here is my logstash pipeline input plugin: ```yaml input{ #input of palo alto firewall logs - SNMPv3 over udp/port snmp{ id => "paloalto" ecs_compatibility => "v8" #store SNMP payload under [snmp] to avoid root clashes under ECS target => "snmp" #Palo Alto Firewall host hosts => [{host => "udp:" community => "" version => "3"}] #v3 - security #OIDs oid_mapping_format => "default" #oid_mapping_format => "ruby_snmp" #oid_mapping_format => "dotted_string" get => [ "1.3.6.1.4.1.25461.2.1.2.1.11.0", #Node HA mode "1.3.6.1.4.1.25461.2.1.2.1.12.0", #Peer HA node "1.3.6.1.2.1.25.2.2.0", #Memory "1.3.6.1.4.1.25461.2.1.2.3.1.0", #Session Statistics "1.3.6.1.2.1.25.1.1.0", #System Uptime "1.3.6.1.4.1.25461.2.1.2.5.1.1.0" #Gateway Statistics ] walk => [ "1.3.6.1.4.1.25461.2.1.2.6.1.3.1.2", #Disk free "1.3.6.1.2.1.99.1.1", #PhysSensor: (2) / CPU die Temperature "1.3.6.1.2.1.2.2.1.2", #Traffic 64bit "1.3.6.1.2.1.2.2.1.10", #Traffic 64bit ifInOctets "1.3.6.1.2.1.2.2.1.16" #Traffic 64bit ifOutOctets ] #polling happens every 30 seconds interval => 30 } } ``` Any help is appreciated, i'm currently trying with the ai assistant but no luck ther either. The OID not working is: "1.3.6.1.2.1.25.2.2.0" Kind regards, Tom ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 21, 2026, 2:36pm UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975/2 "2026-04-21T14:36:11Z")
> [@tom.verbeek](#): > > The OID not working is: "1.3.6.1.2.1.25.2.2.0" Are you able to get this using `snmpwalk` or `snmpget` in the CLI? ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [April 21, 2026, 11:33pm UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975/3 "2026-04-21T23:33:53Z")
Another idea is to make simplifier cloned .conf with basic "get" request value which is missing, without any filtering and show in output stdout ruby debug or a file. ---
**Author:** ![tom.verbeek](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@tom.verbeek](https://discuss.elastic.co/u/tom.verbeek)\ **Post date:** [April 22, 2026, 7:22am UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975/4 "2026-04-22T07:22:40Z")
snmpwalk in cli gives the following: %Failed to get value of SNMP variable. Timeout. ---
**Author:** ![tom.verbeek](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@tom.verbeek](https://discuss.elastic.co/u/tom.verbeek)\ **Post date:** [April 22, 2026, 7:36am UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975/5 "2026-04-22T07:36:14Z")
Got no output in my file. used the same input config but only polled the 1 specific OID. no filtering and a file as output. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [April 22, 2026, 8:52am UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975/6 "2026-04-22T08:52:29Z")
Hmm.. Can you accept all traffic from that host,without subtree OIDs? I might be PAlto not sending all data. Edit: A silly question does your device support snmpv3? ---
**Author:** ![tom.verbeek](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@tom.verbeek](https://discuss.elastic.co/u/tom.verbeek)\ **Post date:** [April 22, 2026, 9:00am UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975/7 "2026-04-22T09:00:52Z")
what do you mean with 'accept all traffic' ? do you mean outside of logstash using an snmpwalk or snmpget command in cli? not a silly question: but yes it supports v3. As all other OIDs do work i see no issue there. I also use a second pipeline for Cisco switch snmp data where i use version v2c there everything works except again 1 specific OID. I did some research online and find that the snmp logstash plugin has some limitations. maybe some OIDs are not queryable for the plugin? ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [April 22, 2026, 12:34pm UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975/8 "2026-04-22T12:34:14Z")
Accept all traffic/SNMP message for OID 1.3.6.1.2.1.25.2.0, including subtrees or from brothers/siblings. ```auto ... get => ["1.3.6.1.2.1.25.2.0"] # or for 1.3.6.1.2.1.25.2.3.1 or 1.3.6.1.2.1.25.1.0 ... ``` Is only one host which you query? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 22, 2026, 12:40pm UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975/9 "2026-04-22T12:40:11Z")
> [@tom.verbeek](#): > > snmpwalk in cli gives the following: %Failed to get value of SNMP variable. Timeout. Was this executed from the same machine where logstash is running to rule out any network blocking? If you cannot get the information using `snmpwalk` then I don't think this is an issue in Logstash. Try to confirm it, do a `snmpwalk` or `snmpget` using one of the OIDs that you are receving through logstash, than test with the one that is not working again. If you can get the first, but not the second, then Logstash would also not be able to get the second OID.