Well, it depends on your use case. A MIB contains data. Your can use a snmp input to poll the MIB and fetch values, or the device that you are monitoring may generate "traps" when those values change, or move beyond thresholds. Those would be collected using an snmptrap input.
Assuming you want to poll, you would configure the snmp input. This polls the uptime from the snmpd listening on localhost.
input {
snmp {
hosts => [ { host => "udp:127.0.0.1/161" } ]
walk => [ "1.3.6.1.2.1.1.3" ]
}
}
This will result in a new event every 30 seconds
{
"@timestamp" => 2019-02-05T22:58:15.602Z,
"iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.sysUpTimeInstance" => 104401,
"host" => "127.0.0.1",
"@version" => "1"
}
{
"@timestamp" => 2019-02-05T22:58:45.604Z,
"iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.sysUpTimeInstance" => 107402,
"host" => "127.0.0.1",
"@version" => "1"
}
If you change that walk to
walk => [ "1.3.6.1.2.1.1" ]
It would fetch all of the values under that id in the MIB and the event would have about 30 fields on it. If you give it the IP address of an APC PDU then
walk => [ ".1.3.6.1.4.1.318.1.1.26.10" ]
should get some interesting data. You will probably need to configure authentication.
Note that for events generated by the snmp input the host field is set to the host that was polled, unlike most other inputs where host is the server that logstash is running on.