# Query Elasticsearch for Cisco telemetry data

**URL:** <https://discuss.elastic.co/t/query-elasticsearch-for-cisco-telemetry-data/126204>\
**Category:** Elasticsearch\
**Created:** [March 30, 2018, 8:11am UTC](https://discuss.elastic.co/t/query-elasticsearch-for-cisco-telemetry-data/126204 "2018-03-30T08:11:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![neerajsapkota](https://avatars.discourse-cdn.com/v4/letter/n/7feea3/32.png) [@neerajsapkota](https://discuss.elastic.co/u/neerajsapkota)\
**Post date:** [March 30, 2018, 8:11am UTC](https://discuss.elastic.co/t/query-elasticsearch-for-cisco-telemetry-data/126204/1 "2018-03-30T08:11:48Z")

</div>

Here is the telemetry data received from cisco router in json. how do i query elasticsearch so that i get all the InterfaceStatistics per InterfaceName ..  
Eg: Bundle-Ether3.400.pppoe25235 ----- \> InterfaceStatistics": {  
"StatsType": "Basic",  
"BasicInterfaceStats": {  
"PacketsReceived": 120083,  
"BytesReceived": 69410077,  
"PacketsSent": 102390,  
"BytesSent": 96602944,  
"InputDrops": 0,  
"InputQueueDrops": 0,  
"InputErrors": 0,  
"UnknownProtocolPacketsReceived": 0,  
"OutputDrops": 0,  
"OutputQueueDrops": 0,  
"OutputErrors": 0,  
"LastDataTime": 1522396851,  
"SecondsSinceLastClearCounters": 0,  
"LastDiscontinuityTime": 1522389135,  
"SecondsSincePacketReceived": 0,  
"SecondsSincePacketSent": 0  
}

JSON DATA................... START !!!!!!!!!

"\_index": "logstash-2018.03.30",  
"\_type": "interfacesPre601",  
"\_id": "AWJ17ISCRLcFO1Wq-MTb",  
"\_score": null,  
"\_source": {  
"path": "DATA~RootOper~Interfaces~Interface",  
"type": "interfacesPre601",  
"content": {  
"interfacesPre601": [  
{  
"InterfaceName": "Bundle-Ether3.400.pppoe25235",  
"CollectionTime": 1522396851133,  
"InterfaceHandle": "Bundle-Ether3.400.pppoe25235",  
"InterfaceType": "IFT\_PPPOE",  
"HardwareTypeString": "PPPoE interface(s)",  
"State": "IM\_STATE\_UP",  
"LineState": "IM\_STATE\_UP",  
"Encapsulation": "ppp",  
"EncapsulationTypeString": "PPP",  
"MTU": 1500,  
"IsL2TransportEnabled": false,  
"StateTransitionCount": 1,  
"LastStateTransitionTime": 7717,  
"IsDampeningEnabled": false,  
"Speed": 30000000,  
"MACAddress": {  
"Address": "0896.ad43.5a62"  
},  
"Bandwidth": 30000000,  
"MaxBandwidth": 30000000,  
"Keepalive": 10,  
"IsL2Looped": false,  
"ParentInterfaceName": "Bundle-Ether3.400",  
"Description": "",  
"IPInformation": {  
"IPAddress": "192.168.2.2",  
"SubnetMaskLength": 32  
},  
"EncapsulationInformation": {  
"EncapsulationType": "PPP",  
"PPPInformation": {  
"LCPState": "PPP\_FSM\_STATE\_OPENED\_9",  
"IsLoopbackDetected": 0,  
"KeepalivePeriod": 10,  
"IsMPBundleMember": 0,  
"IsMultilinkOpen": 0,  
"NCPInfoArray": [  
{  
"NCPState": "PPP\_FSM\_STATE\_OPENED\_9",  
"NCPIdentifier": "IPCP"  
}  
]  
}  
},  
"InterfaceStatistics": {  
"StatsType": "Basic",  
"BasicInterfaceStats": {  
"PacketsReceived": 120083,  
"BytesReceived": 69410077,  
"PacketsSent": 102390,  
"BytesSent": 96602944,  
"InputDrops": 0,  
"InputQueueDrops": 0,  
"InputErrors": 0,  
"UnknownProtocolPacketsReceived": 0,  
"OutputDrops": 0,  
"OutputQueueDrops": 0,  
"OutputErrors": 0,  
"LastDataTime": 1522396851,  
"SecondsSinceLastClearCounters": 0,  
"LastDiscontinuityTime": 1522389135,  
"SecondsSincePacketReceived": 0,  
"SecondsSincePacketSent": 0  
}  
},  
"IfIndex": 0  
},  
{  
"InterfaceName": "Bundle-Ether3.400.pppoe25243",  
"CollectionTime": 1522396851144,  
"InterfaceHandle": "Bundle-Ether3.400.pppoe25243",  
"InterfaceType": "IFT\_PPPOE",  
"HardwareTypeString": "PPPoE interface(s)",  
"State": "IM\_STATE\_UP",  
"LineState": "IM\_STATE\_UP",  
"Encapsulation": "ppp",  
"EncapsulationTypeString": "PPP",  
"MTU": 1500,  
"IsL2TransportEnabled": false,  
"StateTransitionCount": 1,  
"LastStateTransitionTime": 7717,  
"IsDampeningEnabled": false,  
"Speed": 30000000,  
"MACAddress": {  
"Address": "0896.ad43.5a62"  
},  
"Bandwidth": 30000000,  
"MaxBandwidth": 30000000,  
"Keepalive": 10,  
"IsL2Looped": false,  
"ParentInterfaceName": "Bundle-Ether3.400",  
"Description": "",  
"IPInformation": {  
"IPAddress": "192.168.2.2",  
"SubnetMaskLength": 32  
},  
"EncapsulationInformation": {  
"EncapsulationType": "PPP",  
"PPPInformation": {  
"LCPState": "PPP\_FSM\_STATE\_OPENED\_9",  
"IsLoopbackDetected": 0,  
"KeepalivePeriod": 10,  
"IsMPBundleMember": 0,  
"IsMultilinkOpen": 0,  
"NCPInfoArray": [  
{  
"NCPState": "PPP\_FSM\_STATE\_OPENED\_9",  
"NCPIdentifier": "IPCP"  
}  
]  
}  
},  
"InterfaceStatistics": {  
"StatsType": "Basic",  
"BasicInterfaceStats": {  
"PacketsReceived": 188398,  
"BytesReceived": 24718816,  
"PacketsSent": 961402,  
"BytesSent": 1324366371,  
"InputDrops": 4,  
"InputQueueDrops": 0,  
"InputErrors": 0,  
"UnknownProtocolPacketsReceived": 0,  
"OutputDrops": 4317,  
"OutputQueueDrops": 0,  
"OutputErrors": 0,  
"LastDataTime": 1522396851,  
"SecondsSinceLastClearCounters": 0,  
"LastDiscontinuityTime": 1522389136,  
"SecondsSincePacketReceived": 0,  
"SecondsSincePacketSent": 0  
}  
},  
"IfIndex": 0  
},

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2018, 8:11am UTC](https://discuss.elastic.co/t/query-elasticsearch-for-cisco-telemetry-data/126204/2 "2018-04-27T08:11:56Z")

</div>

Closed on April 27, 2018, 8:11am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.