I'm using Logstash to query a network device that has a large number of interfaces (nearly 1500). I'm interested in a variety of interface metrics that are stored in different tables. I only need the metrics from the first 200 interfaces in each table and currently have a filter set to drop interfaces above a specific index number.
The problem I'm running into is that the number of metrics plus the time it takes to poll such large tables is extending the polling intervals out farther than I'd like. My pipeline would run a lot faster if I could specify the range of the 200 interfaces I want, in the input. You can do something similar when you use the snmpwalk -CE flag:
snmpwalk -v 1 -c public -m ALL -CE 1.3.6.1.2.1.2.2.1.8.1000000000 10.100.253.18 1.3.6.1.2.1.2.2.1.8
(snmpwalk -- retrieve a subtree of management values using SNMP GETNEXT requests).
Is there any similar technique I can apply to the input of my logstash config that would allow me to only poll a portion of the table, rather than pulling in the entire table in the input {} and dropping what I don't need in the filter {}?
Thanks for your help,
Ben