Snmptrap throwing errors

Elastic Stack Logstash
1

Hello,

I configured an input for receiving snmp traps. However non of them get stored in elasticsearch. When looking at the output of rubydebug errors showe up:

ailed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-prtrap-2016.02.24", :_type=>"prtrap", :_routing=>nil}, #<LogStash::Event:0x261fae28 @metadata_accessors=#<LogStash::Util::Accessors:0x692a5f5f @store={}, @lut={}>, @cancelled=false, @data={"message"=>"#<SNMP::SNMPv2_Trap:0x1fc329e6 @request_id=658842679, @error_index=0, @error_status=0.....
...
:response=>{"create"=>{"_index"=>"logstash-prtrap-2016.02.24", "_type"=>"prtrap", "_id"=>"AVMSmlv7r0d0YpfXvMzQ", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Field name [RFC1065-SMI::enterprises.9.9.712.1.1.2.1.10.0] cannot contain '.'"}}}, :level=>:warn}

logstash-2.2.0
elasticsearch-2.2.0

Regards,
massimo

2

As of Elasticsearch 2.0, field names can't contain periods. Consider using the de_dot filter.

3

Magnus, thank you. I was able to solve this by using the suggested filter.