# SNMP input (how to configure)

**URL:** https://discuss.elastic.co/t/snmp-input-how-to-configure/183105
**Category:** Logstash
**Created:** [May 28, 2019, 1:13pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105 "2019-05-28T13:13:44Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![inter07](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inter07/32/46977_2.png) [@inter07](https://discuss.elastic.co/u/inter07)
#### Post date: [May 28, 2019, 1:13pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105/1 "2019-05-28T13:13:44Z")

</div>

Hi!  
Could You please help to configure SNMP input in the Logstash.  
I 've tried to use the official documentation, but got some problems.(  
My input configuration is:

```
{
    input {
      snmp {

    get => ["1.3.6.1.4.1.14876"]
    hosts => [{host => "udp:10.10.108.17/161"}]

    mib_paths => ["/root/mib/RFC1213-MIB.dic"]
    oid_root_skip => 0
    interval => 30
  }
}

```

And in logs I'm getting the next errors:

```
[2019-05-28T16:04:06,720][ERROR][logstash.pipeline] Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::Snmp mib_paths=>[\"root/mib/RFC1213-MIB.dic\"], oid_root_skip=>0, interval=>30, id=>\"1008b99d29004ebd8e92048301b71e1b78c7305817d63883182fe7b216d9b4d7\", hosts=>[{\"host\"=>\"udp:10.10.108.17/161\"}], get=>[\"1.3.6.1.4.1.14876\"], enable_metric=>true, codec=><LogStash::Codecs::Plain id=>\"plain_cad67756-c145-4779-8765-c6f81e2dd0cd\", enable_metric=>true, charset=>\"UTF-8\">, add_field=>{\"host\"=>\"%{[@metadata][host_address]}\"}, use_provided_mibs=>true>", :error=>"file or directory path expected: root/mib/RFC1213-MIB.dic", :thread=>"#<Thread:0x5ac66d61 run>"}
[2019-05-28T16:04:15,786][ERROR][logstash.pipeline] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<LogStash::SnmpMibError: file or directory path expected: root/mib/RFC1213-MIB.dic>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp/mib.rb:108:in `add_mib_path'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:106:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:104:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:259:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:413:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:311:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:217:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:176:in `block in start'"], :thread=>"#<Thread:0x5ac66d61 run>"}
[2019-05-28T16:04:15,810][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

```

What should I check?  
Thank you in advance!

---

<div class="post-metadata">

### Author: ![inter07](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inter07/32/46977_2.png) [@inter07](https://discuss.elastic.co/u/inter07)
#### Post date: [May 28, 2019, 1:27pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105/2 "2019-05-28T13:27:37Z")

</div>

If I'm using some software like SNMPWALK I'm getting some results (like below)

 ![snmp_walk](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2aed4f5aa2827128e8625a68fc23afbba2256b1d.jpeg)

---

<div class="post-metadata">

### Author: ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)
#### Post date: [May 28, 2019, 1:45pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105/3 "2019-05-28T13:45:55Z")

</div>

> [@inter07](#):
>
> :error=\>"file or directory path expected: root/mib/RFC1213-MIB.dic"

I have never uses snmp input before, but you are missing an "/" before root  
Maybe that´s it

---

<div class="post-metadata">

### Author: ![inter07](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inter07/32/46977_2.png) [@inter07](https://discuss.elastic.co/u/inter07)
#### Post date: [May 28, 2019, 1:54pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105/4 "2019-05-28T13:54:23Z")

</div>

> [@inter07](#):
>
> Error registering plugin

Thanks, but it didn't help. The error is the same. Do you have any other ideas?

```
[2019-05-28T16:51:45,092][ERROR][logstash.pipeline] Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::Snmp mib_paths=>[\"/root/mib/RFC1213-MIB.dic\"], oid_root_skip=>0, interval=>30, id=>\"e89b6b460a73217f7ae4f43ad6d7d7768d8bbac170d5c6a0f1c46f3dea6e1d85\", hosts=>[{\"host\"=>\"udp:10.10.108.17/161\"}], get=>[\"1.3.6.1.4.1.14876\"], enable_metric=>true, codec=><LogStash::Codecs::Plain id=>\"plain_6df6c2c8-7409-4fd6-a37e-92a5e280e643\", enable_metric=>true, charset=>\"UTF-8\">, add_field=>{\"host\"=>\"%{[@metadata][host_address]}\"}, use_provided_mibs=>true>", :error=>"file or directory path expected: /root/mib/RFC1213-MIB.dic", :thread=>"#<Thread:0x2b8f94d5 run>"}
[2019-05-28T16:51:56,280][ERROR][logstash.pipeline] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<LogStash::SnmpMibError: file or directory path expected: /root/mib/RFC1213-MIB.dic>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp/mib.rb:108:in `add_mib_path'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:106:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:104:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:259:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:413:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:311:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:217:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:176:in `block in start'"], :thread=>"#<Thread:0x2b8f94d5 run>"}
[2019-05-28T16:51:56,326][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

```

---

<div class="post-metadata">

### Author: ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)
#### Post date: [May 28, 2019, 1:59pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105/5 "2019-05-28T13:59:58Z")

</div>

> [@inter07](#):
>
> mib\_paths =\> ["/root/mib/RFC1213-MIB.dic"]

mib\_paths should be a path. not an array. maybe it is just the brackets which are resulting in an error.

---

<div class="post-metadata">

### Author: ![inter07](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inter07/32/46977_2.png) [@inter07](https://discuss.elastic.co/u/inter07)
#### Post date: [May 28, 2019, 3:30pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105/6 "2019-05-28T15:30:09Z")

</div>

It also doesn't work ☹  
The error is the same.

```
[2019-05-28T18:28:16,703][INFO][logstash.inputs.snmp] using user provided MIB path /root/mib/RFC1213-MIB.dic
[2019-05-28T18:28:16,720][ERROR][logstash.pipeline] Error registering plugin {:pipeline_id=>"main", :plugin=>"<LogStash::Inputs::Snmp mib_paths=>[\"/root/mib/RFC1213-MIB.dic\"], oid_root_skip=>0, interval=>30, id=>\"87afd06f4aa949b7c26235725875e1230291d565b92cad9f16a6229b256e8371\", hosts=>[{\"host\"=>\"udp:10.10.108.17/161\"}], get=>[\"1.3.6.1.4.1.14876\"], enable_metric=>true, codec=><LogStash::Codecs::Plain id=>\"plain_8c8c9ada-4494-4aec-8844-88d01d91e293\", enable_metric=>true, charset=>\"UTF-8\">, add_field=>{\"host\"=>\"%{[@metadata][host_address]}\"}, use_provided_mibs=>true>", :error=>"file or directory path expected: /root/mib/RFC1213-MIB.dic", :thread=>"#<Thread:0x556efb2e run>"}
[2019-05-28T18:28:25,810][ERROR][logstash.pipeline] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<LogStash::SnmpMibError: file or directory path expected: /root/mib/RFC1213-MIB.dic>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp/mib.rb:108:in `add_mib_path'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:106:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.0.1/lib/logstash/inputs/snmp.rb:104:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:259:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:413:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:311:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:217:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:176:in `block in start'"], :thread=>"#<Thread:0x556efb2e run>"}
[2019-05-28T18:28:25,859][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
[2019-05-28T18:28:26,589][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2019-05-28T18:28:31,230][INFO][logstash.runner] Logstash shut down.
```

---

<div class="post-metadata">

### Author: ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)
#### Post date: [May 28, 2019, 4:04pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105/7 "2019-05-28T16:04:18Z")

</div>

ok, second thought would be that logstash has no read permission in /root/

So maybe you could change it to:

> mib\_paths =\> "/etc/logstash/mib/RFC1213-MIB.dic"

and give the read permissions to user logstash.

If this doesn´t help, then hopefully someone else knows the solution.

---

<div class="post-metadata">

### Author: ![inter07](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inter07/32/46977_2.png) [@inter07](https://discuss.elastic.co/u/inter07)
#### Post date: [May 28, 2019, 4:27pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105/8 "2019-05-28T16:27:48Z")

</div>

Thanks! The problem was with permissions to the root directory. Now it becomes working. The next step -\> I will investigate how to operate with this info) I mean how to "grok it"

Few additional troubles to be fixed:

Problem:

> `object mapping for [host] tried to parse field [host] as object, but found a concrete value`

Solution:

```
mutate {
          remove_field => ["host"]
        }

```

Problem:

> Limit of total fields [3000] in index [unknown\_messages] has been exceeded

Solution:

```
PUT unknown_messages/_settings
{
"index.mapping.total_fields.limit": 9000
}

```

Result:

 ![kibana_result](https://us1.discourse-cdn.com/elastic/original/3X/4/c/4cb2e5ab31a0e7251edbd67fc15acae68f072a7d.jpeg)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 25, 2019, 4:28pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105/9 "2019-06-25T16:28:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.