SNMP input, table index becomes separated

Elastic Stack Logstash
1

I've got the SNMP input configured to poll a number of Cisco devices pulling back interfaces stats from the following OIDs:

              "1.3.6.1.2.1.2.2.1.1",
              "1.3.6.1.2.1.2.2.1.2",
              "1.3.6.1.2.1.2.2.1.3",
              "1.3.6.1.2.1.2.2.1.5",
              "1.3.6.1.2.1.2.2.1.7",
              "1.3.6.1.2.1.2.2.1.8",
              "1.3.6.1.2.1.2.2.1.13",
              "1.3.6.1.2.1.2.2.1.14",
              "1.3.6.1.2.1.2.2.1.19",
              "1.3.6.1.2.1.2.2.1.20",
              "1.3.6.1.2.1.31.1.1.1.6",
              "1.3.6.1.2.1.31.1.1.1.10",
              "1.3.6.1.2.1.31.1.1.1.15"

Initially the data looks fine and a single entry shows per line:

{"ifInDiscards":0,"ifType":6,"ifHCOutOctets":200094875917,"ifOutDiscards":50,"ifHighSpeed":1000,"ifInErrors":0,"ifDescr":"TenGigabitEthernet0/0/0","ifOutErrors":0,"ifSpeed":1000000000,"index":"1","ifHCInOctets":168193171726,"ifAdminStatus":1,"ifOperStatus":1,"ifIndex":1},

but after a while it starts to split into 2 entries, with the same index value:

{"index":"19","ifHighSpeed":1000,"ifHCInOctets":433048048,"ifHCOutOctets":595866704},
{"ifInDiscards":0,"ifType":131,"ifOutDiscards":0,"ifInErrors":0,"ifDescr":"Tunnel1","ifOutErrors":0,"ifSpeed":1000000000,"index":"19","ifAdminStatus":1,"ifOperStatus":1,"ifIndex":19},

This then causes issues when using queries as the data has become disjointed.

What I don't get is why the data starts to split within the table returned.

Any ideas?

2

Found this as a known issue with a ruby filter script to workaround the problem:

Ensure responses with large tables produce a single array with no duplicated elements · Issue #30