Hoping someone has configured logstash to receive Cisco telemetry before, I'm able to receive the events but can't decode the telemetry.
I'm getting the folowing error from logstash:
[WARN ] 2020-09-09 05:18:01.074 [nioEventLoopGroup-2-1] protobuf - Couldn't decode protobuf: #<RuntimeError: Protocol message contained an invalid tag (zero).>.
{
"host" => "10.0.0.130",
"tags" => [
[0] "_protobufdecodefailure"
],
"port" => 60779,
"message" => "\x00\x00\x9A\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x95\bH\x12\x90\x01\n\x06Router\x1A\x01127Cisco-IOS-XE-process-cpu-oper:cpu-usage/cpu-utilizationP\xEE\xE8\xB1\x8A\xC7.ZC\b\xEE\xE8\xB1\x8A\xC7.z\x06\x12\x04keysz2\x12\acontentz\x10\x12\ffive-seconds8\x00z\x15\x12\x13cpu-usage-processes",
"@timestamp" => 2020-09-09T05:18:01.072Z,
"@version" => "1"
Rotuer : Cisco CSRv 16.12 (IOS XR)
Protofile is sourced from Cisco: https://github.com/cisco/bigmuddy-network-telemetry-proto
Specifically I'm using the telemetry.proto file which has been compiled with the google protoc binaries.
Router configuration:
telemetry ietf subscription 1
encoding encode-kvgpb
filter xpath /process-cpu-ios-xe-oper:cpu-usage/cpu-utilization/five-seconds
stream yang-push
update-policy periodic 500
receiver ip address 10.0.0.80 5000 protocol grpc-tcp
Logstash configuration file:
input {
tcp {
port => 5000
codec => protobuf {
class_name => "telemetry.Telemetry"
class_file => '/home/scott/proto/telemetry_pb.rb'
protobuf_root_directory => "/home/scott/proto/"
protobuf_version => 3
}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
}
stdout {
codec => rubydebug
}
}