# Snmp grok filter failure

**URL:** <https://discuss.elastic.co/t/snmp-grok-filter-failure/190532>\
**Category:** Logstash\
**Created:** [July 15, 2019, 12:33pm UTC](https://discuss.elastic.co/t/snmp-grok-filter-failure/190532 "2019-07-15T12:33:12Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![liqinnetgain](https://avatars.discourse-cdn.com/v4/letter/l/90db22/32.png) [@liqinnetgain](https://discuss.elastic.co/u/liqinnetgain)\
**Post date:** [July 15, 2019, 12:33pm UTC](https://discuss.elastic.co/t/snmp-grok-filter-failure/190532/1 "2019-07-15T12:33:13Z")

</div>

Here's my line  
iso.3.6.1.4.1.2440.1.11.2.4.8.0 = Counter64: 0  
And the filter  
input {  
stdin {}  
}

```
    input {
      snmp {
        get => ["1.3.6.1.4.1.2440.1.11.2.4.8.0"]
        hosts => [{host => "udp:10.0.10.108/161" community => "public" version => "2c" retries => 2 timeout=> 1000}]
        interval => 10
      }
    }

    filter {
    grok {
        match => {
          "message" => "[iso].*? .*? %{NUMBER}"
        }
        overwrite => ["message"]
      }
    }

output {
  stdout {
    codec => rubydebug
  }
}

```

I tested in the debugger and seems everything is fine  
but when I run  
`sudo /usr/share/logstash/bin/logstash -f test-s.conf`  
Cannot filter with \_grokparsefailure  
{  
"@timestamp" =\> 2019-07-15T12:31:19.301Z,  
"host" =\> "10.0.10.108",  
"tags" =\> [  
[0] "\_grokparsefailure"  
],  
"@version" =\> "1",  
"iso.org.dod.internet.private.enterprises.2440.1.11.2.4.8.0" =\> 0  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 15, 2019, 2:15pm UTC](https://discuss.elastic.co/t/snmp-grok-filter-failure/190532/2 "2019-07-15T14:15:07Z")

</div>

> [@liqinnetgain](#):
>
> match =\> { "message" =\> "[iso]._? ._? %{NUMBER}" }

What are you hoping that will do?

---

<div class="post-metadata">

**Author:** ![liqinnetgain](https://avatars.discourse-cdn.com/v4/letter/l/90db22/32.png) [@liqinnetgain](https://discuss.elastic.co/u/liqinnetgain)\
**Post date:** [July 15, 2019, 7:59pm UTC](https://discuss.elastic.co/t/snmp-grok-filter-failure/190532/3 "2019-07-15T19:59:16Z")

</div>

I hope the result be like  
{  
"@timestamp" =\> 2019-07-15T14:09:24.960Z,  
"host" =\> "10.0.10.108",  
"@version" =\> "1",  
"snmpdata" =\> 0  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 15, 2019, 8:13pm UTC](https://discuss.elastic.co/t/snmp-grok-filter-failure/190532/4 "2019-07-15T20:13:46Z")

</div>

So you want to rename a field from iso.org.dod.internet.private.enterprises.2440.1.11.2.4.8.0 to snmpdata, is that correct?

---

<div class="post-metadata">

**Author:** ![liqinnetgain](https://avatars.discourse-cdn.com/v4/letter/l/90db22/32.png) [@liqinnetgain](https://discuss.elastic.co/u/liqinnetgain)\
**Post date:** [July 15, 2019, 8:16pm UTC](https://discuss.elastic.co/t/snmp-grok-filter-failure/190532/5 "2019-07-15T20:16:33Z")

</div>

> [@Badger](#):
>
> iso.org.dod.internet.private.enterprises.2440.1.11.2.4.8.0

I want to split the message into two parts  
{oid: iso.anyoid  
value: snmpvalue  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 15, 2019, 8:32pm UTC](https://discuss.elastic.co/t/snmp-grok-filter-failure/190532/6 "2019-07-15T20:32:25Z")

</div>

Interesting, normally people want to do the opposite of that. You can do it using a ruby filter. If there will ever be more than one piece of data you could use

```
    ruby {
        code => '
            a = []
            event.to_hash.each { |k, v|
                if k.start_with?("iso.org.dod.internet") then
                    h = Hash.new
                    h["oid"] = k
                    h["snmpdata"] = v
                    a << h
                    event.remove(k)
                end
            }
            event.set("someField", a)
        '
    }

```

If you know there will only be one then take the array out of it and use the hash in event.set

---

<div class="post-metadata">

**Author:** ![liqinnetgain](https://avatars.discourse-cdn.com/v4/letter/l/90db22/32.png) [@liqinnetgain](https://discuss.elastic.co/u/liqinnetgain)\
**Post date:** [July 15, 2019, 8:36pm UTC](https://discuss.elastic.co/t/snmp-grok-filter-failure/190532/7 "2019-07-15T20:36:40Z")

</div>

@Badger Thanks for your help. I'll try to use ruby filter as there might be some calcualtion of the value and the OID would be different.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 12, 2019, 8:36pm UTC](https://discuss.elastic.co/t/snmp-grok-filter-failure/190532/8 "2019-08-12T20:36:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.