# MIB OID Translation for the same oid?

**URL:** <https://discuss.elastic.co/t/mib-oid-translation-for-the-same-oid/50065>\
**Category:** Logstash\
**Created:** [May 15, 2016, 6:45am UTC](https://discuss.elastic.co/t/mib-oid-translation-for-the-same-oid/50065 "2016-05-15T06:45:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mattcrawfoord](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@mattcrawfoord](https://discuss.elastic.co/u/mattcrawfoord)\
**Post date:** [May 15, 2016, 6:45am UTC](https://discuss.elastic.co/t/mib-oid-translation-for-the-same-oid/50065/1 "2016-05-15T06:45:06Z")

</div>

hi all,

i have two MIB file : TCP-MIB.yaml and RFC1213-MIB.yam all have defined the oid as follows,

```
tcpConnState: 1.3.6.1.2.1.6.13.1.1

```

from kibana ,

```
RFC1213-MIB::tcpConnState.14.32.100.75.2065.172.18.86.111.23092 4

```

As you can see part of the OID is translated. Namely 1.3.6.1.2.1.6.13.1.1 into RFC1213-MIB::tcpConnState.  
i am confused about it why the oid defined in two MIB file, but why the logstash translate from RFC1213-MIB file ?  
how to work for the translation ?

---

<div class="post-metadata">

**Author:** ![LetMeR00t](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LetMeR00t](https://discuss.elastic.co/u/LetMeR00t)\
**Post date:** [May 15, 2016, 7:56am UTC](https://discuss.elastic.co/t/mib-oid-translation-for-the-same-oid/50065/3 "2016-05-15T07:56:28Z")

</div>

Hello,

How do you used the "yamlmibdir" option ?

---

<div class="post-metadata">

**Author:** ![mattcrawfoord](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@mattcrawfoord](https://discuss.elastic.co/u/mattcrawfoord)\
**Post date:** [May 15, 2016, 8:48am UTC](https://discuss.elastic.co/t/mib-oid-translation-for-the-same-oid/50065/4 "2016-05-15T08:48:06Z")

</div>

yamlmibdir =\> "/opt/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/data/ruby/snmp/mibs"

---

<div class="post-metadata">

**Author:** ![LetMeR00t](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LetMeR00t](https://discuss.elastic.co/u/LetMeR00t)\
**Post date:** [May 15, 2016, 9:37am UTC](https://discuss.elastic.co/t/mib-oid-translation-for-the-same-oid/50065/5 "2016-05-15T09:37:30Z")

</div>

I don't know if you want to have the RFC1213 yaml file but I think that Logstash find in these file and the first file with a result is RFC1213 (and not TCP-MIB).

If you want to have TCP-MIB only, I suggest you to have your own folder with yaml files describing oids. (juste place the TCP-MIB.yaml into this new file and specify the new path to "yamlmibdir")

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/mib-oid-translation-for-the-same-oid/50065/6 "2017-07-06T04:57:34Z")

</div>

Closed on July 6, 2017, 4:57am UTC