Hello,
I have the following Logstash config
input {
snmp {
tags => [ "snmp" ]
get => [".1.3.6.1.4.1.9.9.48.1.1.1.5.2",".1.3.6.1.4.1.9.9.109.1.1.1.1.5.1",".1.3.6.1.4.1.9.9.48.1.1.1.5.1"]
hosts => [{host => "udp:IP/161" community => "public" version => "2c" retries => 2 timeout => 1000}]
tables => [ {"name" => "interfaces" "columns" => ["1.3.6.1.2.1.2.2.1.1", "1.3.6.1.2.1.2.2.1.2", "1.3.6.1.2.1.31.1.1.1.6", "1.3.6.1.2.1.31.1.1.1.10"]}]
}
}
filter {
split {
field => "interfaces"
}
mutate {
rename => { "[interfaces][index]" => "index" }
rename => { "[interfaces][iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifIndex]" => "ifIndex" }
rename => { "[interfaces][iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifDescr]" => "ifDescr" }
rename => { "[interfaces][iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets]" => "ifHCInOctets" }
rename => { "[interfaces][iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCOutOctets]" => "ifHCOutOctets" }
}
mutate {
convert => {
"ifInOctets" => "integer"
"ifOutOctets" => "integer"
}
}
mutate {
remove_field => [ "interfaces", "@version" ]
}
}
output {
stdout
{
codec => rubydebug
}
The config it self does work but when I run it for test, then the output from the get is added to each interface output for example:
{
"@timestamp" => 2023-07-14T20:25:24.619586115Z,
"index" => "30",
"iso.org.dod.internet.private.enterprises.9.9.48.1.1.1.5.1" => 173542416,
"iso.org.dod.internet.private.enterprises.9.9.109.1.1.1.1.5.1" => 15,
"ifDescr" => "Virtual-Access1",
"ifHCInOctets" => 0,
"iso.org.dod.internet.private.enterprises.9.9.48.1.1.1.5.2" => 17675040,
"host" => {
"ip" => "172.16.0.254"
},
"tags" => [
[0] "snmp"
],
"ifHCOutOctets" => 0,
"ifIndex" => 30
}
{
"@timestamp" => 2023-07-14T20:25:24.619586115Z,
"index" => "31",
"iso.org.dod.internet.private.enterprises.9.9.48.1.1.1.5.1" => 173542416,
"iso.org.dod.internet.private.enterprises.9.9.109.1.1.1.1.5.1" => 15,
"ifDescr" => "Virtual-Access2",
"ifHCInOctets" => 195300854095,
"iso.org.dod.internet.private.enterprises.9.9.48.1.1.1.5.2" => 17675040,
"host" => {
"ip" => "172.16.0.254"
},
"tags" => [
[0] "snmp"
],
"ifHCOutOctets" => 12702042208,
"ifIndex" => 31
}
Is there a way, that the SNMP values from the get command is wriiten only one time as own field or is this not possible and I have to create a second File with the get values?
I hope it is clear what I am trying to do.
Thank you for your help.