how to monitor SNMP devices using ElasticSearch on SO ?

[ginobyte]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

200

Storage for /nsm

400

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Sorry I'm newbuy in ELK stack. I'm comparing SO with a commercial Performance monitor product, I'm analyzing network metrics using SNMP and I would like to try to understand if I can get the same results with SO. I saw that in an original Logstash installation it is possible to use SNMP plugin. Is there a way to use it also in SO without doing custom configurations? Are there any guides, I'm not very familiar with pipeline configurations. Thanks in advance for your help

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[TotieBash]

I use SO built in Telegraf container to grab SNMPv3 from my Cisco devices... But I don't use ELK for SNMP but I use TIG stack. TIG uses Influxdb for storage but you can configure Telegraf to output to Elastic if that is the route you want. The new SO v2.4 does not have Grafana anymore but I still use Grafana to show me all this. I use ELK for my Cisco syslog though...

https://github.com/influxdata/telegraf/blob/master/plugins/inputs/snmp/README.md
https://github.com/influxdata/telegraf/blob/master/plugins/outputs/elasticsearch/README.md