Retrieving data through a cli interface (ssh/telnet)

Noob situation and questions:

I have a setup where I can run filebeat and send updated logs back to elasticsearch. This works well on conventional linux servers where I can control what is installed. However, some entities have additional information that I may want to retrieve (a cisco router, for example). This Router may or may not have a REST interface so it seems like something as simple as screen scraping a cli to retrieve statistics is the Least common denominator.

  1. Is there a plugin that I can use to scrape a cli interface via telnet or ssh ?
  2. Is there a plugin to retrieve information over a restApi ?
  3. Is there a better way of retrieving information that may not be presented via a standard syslog interface?


  1. exec or pipe?
  2. http_poller
  3. That question is too open for a useful answer.

Thank you for your response Magnus.

It sounds like there isn't a generic plugin created where you could do something along the lines of:

retrieve("show interface Gigabit-Ethernet 0/0");

This could be done, for example, in expect or other scripting languages, just wondered if someone had a plugin that would do this with a simple API (aka, not reinventing the wheel).

re: 3 - There is a lot of legacy gear that does not support REST (thanks for the http_poller lead), so retrieving config is only really possible by saving off the config, or doing the equivalent of "show run". I would like to be able to get that output and place it into elasticsearch.

It sounds like you are letting me know that nothing standard exists at this time and its just a matter of scripting the ssh/telnet login + capture of data to be sent to logstash, correct ?

Yeah, I think you need to write a small amount of scripting glue to accomplish what you want. It sounds like you'll want to use the exec input plugin.