search

logstash-plugins / logstash-input-snmptrap

Apache License 2.0
12 stars 20 forks source link

This filter may not work in Elasticsearch 2.0 #13

Open webmstr opened 9 years ago

webmstr commented 9 years ago

If you have a trap that is not fully parsed (all elements are not found in the mib), this filter will make new fields based on the object id. Unfortunately, these contain periods, which are not allowed in ES2.

Example: 1.3.6.1.4.1

There are a couple of solutions for this, which could be combined to make the input more useful:

For unknown IDs, make a better string, e.g. 1_3_6_1_4_1.

Allow the user to define what to do with unknown IDs, e.g. "skip_unknown" => true

Having the skip feature would allow users to keep just what they wanted by limited the mib definition to just the fields that interested them. Two birds with one stone...

Note that traps change all the time - vendors add new ids, etc - and keeping the mibs perfectly up to date is typically not possible.

martsa1 commented 8 years ago

I've just bounced off this problem where we are supplied with mibs that aren't complete/malformed etc.