# SNMP - loss of data when sending information from logstash to elasticsearch

**URL:** <https://discuss.elastic.co/t/snmp-loss-of-data-when-sending-information-from-logstash-to-elasticsearch/158214>\
**Category:** Logstash\
**Created:** [November 26, 2018, 4:02pm UTC](https://discuss.elastic.co/t/snmp-loss-of-data-when-sending-information-from-logstash-to-elasticsearch/158214 "2018-11-26T16:02:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rueldu](https://avatars.discourse-cdn.com/v4/letter/r/e36b37/32.png) [@rueldu](https://discuss.elastic.co/u/rueldu)\
**Post date:** [November 26, 2018, 4:02pm UTC](https://discuss.elastic.co/t/snmp-loss-of-data-when-sending-information-from-logstash-to-elasticsearch/158214/1 "2018-11-26T16:02:44Z")

</div>

Hello everyone,

I have installed ELK, one server ELASTICSEARCH, 3 servers (collectors) that have installed LOGSTASH and ELASTIFLOW and each one is in 3 branches. In a branch there is a server where logstash is installed and it is collecting SNMP information and then send to ELASTICSEARCH MASTER. All that information shows me through the Kibana Dhasboard, my question is:

Why in kibana I have a minute loss along the whole timestap?

 ![02%20PM](https://us1.discourse-cdn.com/elastic/original/3X/e/3/e386efa2e00819e49d2960a290f86f4a71856061.png)

these is my config logstash input:

**input {**  
\*\* snmp {\*\*  
\*\* walk =\> ["1.3.6.1.2.1.1", "1.3.6.1.2.1.2", "1.3.6.1.4.1.9.9.109.1.1"]\*\*  
\*\* # get =\> ["1.3.6.1.2.1.2.2.1.10.10102", "1.3.6.1.2.1.2.2.1.16.10102"]\*\*  
**# walk =\> ["1.3.6.1.2.1.1"]**  
\*\* hosts =\> [{host =\> "udp:x.x.x.x/161" community =\> "public"}]\*\*  
\*\* mib\_paths =\> ["/etc/logstash/mibs/"]\*\*  
\*\* add\_field =\> {host =\> "%{[@metadata][host\_protocol]}:%{[@metadata][host\_address]}/%{[@metadata][host\_port]},%{[@metadata][host\_community]}"}\*\*  
\*\* }\*\*  
**}**

and these is my output:

**output {**  
\*\* elasticsearch {\*\*  
\*\* id =\> "output\_elasticsearch\_single"\*\*  
\*\* document\_type =\> "elasticsearch"\*\*  
\*\* hosts =\> ["[http://y.y.y.y:9200](http://y.y.y.y:9200)"]\*\*  
**# index =\> "{%[@metadata][snmp]}-%{+YYYY.MM.dd}"**  
\*\* index =\> "snmp-cisco-%{+YYYY.MM.dd}"\*\*  
\*\* }\*\*  
**}**

According to me, the logstash log does not show me any error:

 ![35%20PM](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e59b73a2058f20d10b9ca0a284d5425ccab7c884.png)

Help!! a new on ELK.

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 27, 2018, 8:12am UTC](https://discuss.elastic.co/t/snmp-loss-of-data-when-sending-information-from-logstash-to-elasticsearch/158214/2 "2018-11-27T08:12:52Z")

</div>

Hi,

This is not 1 minute "missing" but rather it is 30 seconds. You need to set the polling interval in the SNMP plugin to tell it how long between walk intervals.

---

<div class="post-metadata">

**Author:** ![rueldu](https://avatars.discourse-cdn.com/v4/letter/r/e36b37/32.png) [@rueldu](https://discuss.elastic.co/u/rueldu)\
**Post date:** [November 27, 2018, 3:42pm UTC](https://discuss.elastic.co/t/snmp-loss-of-data-when-sending-information-from-logstash-to-elasticsearch/158214/3 "2018-11-27T15:42:19Z")

</div>

Hello Eniqmatic, well if you're right, deafult the polling intervals is 30 seconds as it says here: [https://www.elastic.co/guide/en/logstash/current/plugins-inputs-snmp.html](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-snmp.html)

so I added the interval =\> 0 line in the logstash.yml configuration and with that I already have a single timeline without jumps.

**Logstash input:**

input {  
snmp {  
walk =\> ["1.3.6.1.2.1.1", "1.3.6.1.2.1.2", "1.3.6.1.4.1.9.9.109.1.1"]  
get =\> ["1.3.6.1.2.1.2.2.1.10.10102", "1.3.6.1.2.1.2.2.1.16.10102"]  
hosts =\> [{host =\> "udp:x.x.x.x/161" community =\> "public"}]

```
mib_paths => ["/etc/logstash/mibs/"]
oid_root_skip => 5
**interval => 0**
add_field => {host => "%{[@metadata][host_protocol]}:%{[@metadata][host_address]}/%{[@metadata][host_port]},%{[@metadata][host_community]}"}
}

```

}

TimeLine:

 ![02%20PM](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a08162f2c2a8edac5395e4e27012724bb4aaeae.png)

Thank Eniqmatic!!

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 27, 2018, 3:46pm UTC](https://discuss.elastic.co/t/snmp-loss-of-data-when-sending-information-from-logstash-to-elasticsearch/158214/4 "2018-11-27T15:46:18Z")

</div>

Good news! Please mark as solved!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 25, 2018, 3:46pm UTC](https://discuss.elastic.co/t/snmp-loss-of-data-when-sending-information-from-logstash-to-elasticsearch/158214/5 "2018-12-25T15:46:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.