logstash-integration-snmp 4.2.2-java → 4.3.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d3ed1e4918623aa0ae361f25307932f551fd20c43ccf0b1129ef92323ba68d2
-  data.tar.gz: ef6b85b7c9e9006cec7c946da939efe36de89d367cf764c0adac47740adf469f
+  metadata.gz: 00b54144b7fb2f7a2504757c195376ea69d30baf878855007afb969f9c6bb372
+  data.tar.gz: 6f8f31cdf110ce9a2b16d632efe00ad888e1145d4dbbce739b885f74a618149a
 SHA512:
-  metadata.gz: fa65ee4ee74ace48959365b6d34d7e44bc749be894a5e3112a426382e8f1221aafbe611a57b1573ebcf6268d9db63a29cda7bd8c4b551cc07bf6b9b00ef72a1e
-  data.tar.gz: 8210d1dfe26f75ffd0532e4be42f6bcdac4b8ff83c28c40da5d669b8a8e8f6ac217f87e51bce2018454a0c14b33f8be28bc38665914aaf38e09554a6f55b2793
+  metadata.gz: c7262768b0db4a1ccee95e57f979813652860e2ccd3cbc7bde0d3d945216a36d0c6b0a539db5d790be05f0100f9f29713106c1e9acca41be0eebdf0d2d063871
+  data.tar.gz: 94c9a90d25ccf4da3008433c9fb45e001402415a060a26d9d9bb8833bae1a8c29a9303b99eccd26854b743d9680aa8dc7c466fc4b42bc28825dc4a9a4e85d365

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 4.3.1
+  - Fix: generate error events with _snmpfailure tag when all SNMP operations fail and the response data is empty (e.g., timeout) [#92](https://github.com/logstash-plugins/logstash-integration-snmp/pull/92)
+
+## 4.3.0
+  - Handle partial responses and errors gracefully: add `tag_on_failure` (default: `["_snmpfailure"]`) to tag events when SNMP operations fail, and `allow_partial_response` (default: `false`) to preserve partial data from failed `walk`/`table` operations [#91](https://github.com/logstash-plugins/logstash-integration-snmp/pull/91)
+
 ## 4.2.2
   - Re-packaging the plugin [#86](https://github.com/logstash-plugins/logstash-integration-snmp/pull/86)
 

data/VERSION

@@ -1 +1 @@
-4.2.2
+4.3.1

data/docs/input-snmp.asciidoc

@@ -75,6 +75,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-ecs_compatibility>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-get>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-hosts>> |<<array,array>>|No
+| <<plugins-{type}s-{plugin}-allow_partial_response>> |<<boolean,boolean>>|No
 | <<plugins-{type}s-{plugin}-interval>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-local_engine_id>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-mib_paths>> |<<path,path>>|No
@@ -83,6 +84,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-oid_path_length>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-oid_root_skip>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-poll_hosts_timeout>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-tag_on_failure>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-walk>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-tables>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-target>> |<<string,string>>|No
@@ -308,6 +310,7 @@ Queries the subtree of information starting at the given OID(s).
 Example
 [source,ruby]
 -----
+input {
   snmp {
     walk => ["1.3.6.1.2.1.1"]
     hosts => [{host => "udp:127.0.0.1/161" community => "public"}]
@@ -315,6 +318,58 @@ Example
 }
 -----
 
+[id="plugins-{type}s-{plugin}-allow_partial_response"]
+===== `allow_partial_response`
+
+  * Value type is <<boolean,boolean>>
+  * Default value is `false`
+
+When enabled, the event keeps data from partially failed `walk` or `table` operations. By default, it only includes data from fully successful operations.
+
+When a `walk` or `table` traversal encounters an error mid-way through, the SNMP agent may have already returned
+some valid data before the failure. With `allow_partial_response => true`, this data is included in the event.
+The event will still be tagged with <<plugins-{type}s-{plugin}-tag_on_failure>> to indicate that an error occurred.
+
+Example
+[source,ruby]
+-----
+input {
+  snmp {
+    walk => ["1.3.6.1.2.1.2.2"]
+    hosts => [{host => "udp:127.0.0.1/161" community => "public"}]
+    allow_partial_response => true
+  }
+}
+-----
+
+[id="plugins-{type}s-{plugin}-tag_on_failure"]
+===== `tag_on_failure`
+
+  * Value type is <<array,array>>
+  * Default value is `["_snmpfailure"]`
+
+Tags the event when one or more SNMP operations fail for a host.
+This can happen due to timeouts, unreachable hosts, or errors during `get`, `walk`, or `table` operations.
+Detailed error information is logged at ERROR level.
+
+Example
+[source,ruby]
+-----
+input {
+  snmp {
+    get => ["1.3.6.1.2.1.1.1.0"]
+    hosts => [{host => "udp:127.0.0.1/161" community => "public"}]
+    tag_on_failure => ["_snmpfailure"]
+  }
+}
+
+filter {
+  if "_snmpfailure" in [tags] {
+    # handle failed or partial SNMP responses
+  }
+}
+-----
+
 [id="plugins-{type}s-{plugin}-tables"]
 ===== `tables`
 

data/lib/logstash/inputs/snmp.rb

@@ -67,6 +67,13 @@ class LogStash::Inputs::Snmp < LogStash::Inputs::Base
   # Timeout in milliseconds to execute all hosts configured operations (get, walk, table).
   config :poll_hosts_timeout, :validate => :number
 
+  # Append values to the `tags` field when one or more SNMP operations fail
+  config :tag_on_failure, :validate => :array, :default => ['_snmpfailure']
+
+  # When enabled, preserves partial data from failed walk/table operations in the event.
+  # When disabled, only data from fully successful operations is included.
+  config :allow_partial_response, :validate => :boolean, :default => false
+
   def initialize(params={})
     super(params)
 
@@ -161,7 +168,11 @@ class LogStash::Inputs::Snmp < LogStash::Inputs::Base
         definition[:security_level]
       )
 
-      request = @request_aggregator.create_request(@client)
+      if @allow_partial_response
+        request = @request_aggregator.create_request_for_partial_result(@client)
+      else
+        request = @request_aggregator.create_request_for_complete_result(@client)
+      end
       in_flight_requests << { request: request, definition: definition }
 
       if definition[:get].any?
@@ -182,14 +193,16 @@ class LogStash::Inputs::Snmp < LogStash::Inputs::Base
 
     in_flight_requests.each do |req|
       definition = req[:definition]
-      result_consumer = lambda do |result|
-        if result&.any?
+      result_consumer = lambda do |request_result|
+        result = request_result.data
+        if result&.any? || request_result.has_errors
           event = targeted_event_factory.new_event(result)
           event.set(@host_protocol_field, definition[:host_protocol])
           event.set(@host_address_field, definition[:host_address])
           event.set(@host_port_field, definition[:host_port])
           event.set(@host_community_field, definition[:host_community])
           decorate(event)
+          @tag_on_failure.each { |tag| event.tag(tag) } if request_result.has_errors
           queue << event
         else
           logger.debug? && logger.debug('No SNMP data retrieved', host: definition[:host_address])

data/lib/logstash-integration-snmp_jars.rb

@@ -4,4 +4,4 @@ require 'jar_dependencies'
 require_jar('org.snmp4j', 'snmp4j-log4j', '2.8.11')
 require_jar('org.snmp4j', 'snmp4j', '3.8.0')
 require_jar('org.snakeyaml', 'snakeyaml-engine', '2.7')
-require_jar('org.logstash.integrations', 'plugin', '4.2.2')
+require_jar('org.logstash.integrations', 'plugin', '4.3.1')

data/spec/unit/inputs/snmp_spec.rb

@@ -4,6 +4,8 @@ require "logstash/devutils/rspec/spec_helper"
 require 'logstash/plugin_mixins/ecs_compatibility_support/spec_helper'
 require_relative '../../../lib/logstash/inputs/snmp'
 
+java_import 'org.logstash.snmp.RequestResult'
+
 describe LogStash::Inputs::Snmp, :ecs_compatibility_support do
   let(:mock_target) { double("org.snmp4j.Target") }
   let(:mock_client) { double("org.logstash.snmp.SnmpClient") }
@@ -26,7 +28,8 @@ describe LogStash::Inputs::Snmp, :ecs_compatibility_support do
         expect(mock_client).to receive(:close)
 
         allow(plugin).to receive(:create_request_aggregator).and_return(mock_aggregator)
-        expect(mock_aggregator).to receive(:create_request).and_return(mock_aggregator_request)
+        allow(mock_aggregator).to receive(:create_request_for_complete_result).and_return(mock_aggregator_request)
+        allow(mock_aggregator).to receive(:create_request_for_partial_result).and_return(mock_aggregator_request)
         expect(mock_aggregator).to receive(:await).and_return({})
         expect(mock_aggregator).to receive(:close)
 
@@ -225,7 +228,8 @@ describe LogStash::Inputs::Snmp, :ecs_compatibility_support do
       allow(mock_client).to receive(:close).at_most(:once)
 
       allow(plugin).to receive(:create_request_aggregator).and_return(mock_aggregator)
-      expect(mock_aggregator).to receive(:create_request).and_return(mock_aggregator_request)
+      allow(mock_aggregator).to receive(:create_request_for_complete_result).and_return(mock_aggregator_request)
+      allow(mock_aggregator).to receive(:create_request_for_partial_result).and_return(mock_aggregator_request)
       expect(mock_aggregator).to receive(:await)
       allow(mock_aggregator).to receive(:close)
     end
@@ -234,7 +238,7 @@ describe LogStash::Inputs::Snmp, :ecs_compatibility_support do
       before(:each) do
         expect(mock_aggregator_request).to receive(:get)
         expect(mock_aggregator_request).to receive(:get_result_async) do |consumer|
-          consumer.call({ 'foo' => 'bar' })
+          consumer.call(RequestResult.new({ 'foo' => 'bar' }, false))
         end
       end
 
@@ -262,6 +266,18 @@ describe LogStash::Inputs::Snmp, :ecs_compatibility_support do
         end
       end
 
+      context 'should not tag event when no errors' do
+        let(:config) { super().merge({ 'get' => ["1.3.6.1.2.1.1.1.0"], 'hosts' => [{ 'host' => "udp:127.0.0.1/161" }] }) }
+
+        it "does not add tags" do
+          plugin.register
+          plugin.run(queue)
+          event = queue.pop
+
+          expect(event.get("tags")).to be_nil
+        end
+      end
+
       context 'with custom host field (legacy metadata)' do
         let(:config) do
           super().merge({
@@ -318,6 +334,86 @@ describe LogStash::Inputs::Snmp, :ecs_compatibility_support do
       end
     end
 
+    context 'mocked result with errors' do
+      let(:config) do
+        super().merge({
+          'get' => ['1.3.6.1.2.1.1.1.0'],
+          'hosts' => [{ 'host' => 'udp:127.0.0.1/161', 'community' => 'public' }]
+        })
+      end
+
+      context 'when result data is not empty' do
+        before(:each) do
+          expect(mock_aggregator_request).to receive(:get)
+          expect(mock_aggregator_request).to receive(:get_result_async) do |consumer|
+            consumer.call(RequestResult.new({ 'foo' => 'bar' }, true))
+          end
+        end
+
+        it 'should tag event with default failure tag' do
+          plugin.register
+          plugin.poll_clients(queue)
+          event = queue.pop
+
+          expect(event.get("foo")).to eq("bar")
+          expect(event.get("tags")).to include("_snmpfailure")
+          expect(event.get("_snmp_request_errors")).to be_nil
+        end
+      end
+
+      context 'when result data is empty' do
+        before(:each) do
+          expect(mock_aggregator_request).to receive(:get)
+          expect(mock_aggregator_request).to receive(:get_result_async) do |consumer|
+            consumer.call(RequestResult.new({}, true))
+          end
+        end
+
+        it 'should generate an event with failure tag when all operations fail' do
+          plugin.register
+          plugin.poll_clients(queue)
+          event = queue.pop
+
+          expect(event).not_to be_nil
+          expect(event.get("tags")).to include("_snmpfailure")
+        end
+      end
+    end
+
+    context 'allow_partial_response option' do
+      let(:config) do
+        super().merge({
+          'get' => ['1.3.6.1.2.1.1.1.0'],
+          'hosts' => [{ 'host' => 'udp:127.0.0.1/161', 'community' => 'public' }]
+        })
+      end
+
+      before(:each) do
+        allow(mock_aggregator_request).to receive(:get)
+        allow(mock_aggregator_request).to receive(:get_result_async)
+      end
+
+      context 'when set to false (default)' do
+        let(:config) { super().merge('allow_partial_response' => false) }
+
+        it 'uses complete result aggregator' do
+          expect(mock_aggregator).to receive(:create_request_for_complete_result).and_return(mock_aggregator_request)
+          plugin.register
+          plugin.poll_clients(queue)
+        end
+      end
+
+      context 'when set to true' do
+        let(:config) { super().merge('allow_partial_response' => true) }
+
+        it 'uses partial result aggregator' do
+          expect(mock_aggregator).to receive(:create_request_for_partial_result).and_return(mock_aggregator_request)
+          plugin.register
+          plugin.poll_clients(queue)
+        end
+      end
+    end
+
     context 'mocked empty request result' do
       let(:config) do
         super().merge({
@@ -331,7 +427,7 @@ describe LogStash::Inputs::Snmp, :ecs_compatibility_support do
       before(:each) do
         expect(mock_aggregator_request).to receive(:get)
         expect(mock_aggregator_request).to receive(:get_result_async) do |consumer|
-          consumer.call({})
+          consumer.call(RequestResult.new({}, false))
         end
 
         allow(plugin).to receive(:logger).and_return(logger)
@@ -482,7 +578,8 @@ describe LogStash::Inputs::Snmp, :ecs_compatibility_support do
       expect(mock_aggregator).to receive(:await)
       allow(mock_aggregator).to receive(:close)
 
-      expect(mock_aggregator).to receive(:create_request).and_return(mock_aggregator_request)
+      allow(mock_aggregator).to receive(:create_request_for_complete_result).and_return(mock_aggregator_request)
+      allow(mock_aggregator).to receive(:create_request_for_partial_result).and_return(mock_aggregator_request)
       expect(mock_aggregator_request).to receive(:get)
       expect(mock_aggregator_request).to receive(:get_result_async)
     end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: logstash-integration-snmp
 version: !ruby/object:Gem::Version
-  version: 4.2.2
+  version: 4.3.1
 platform: java
 authors:
 - Elastic
 bindir: bin
 cert_chain: []
-date: 2026-01-31 00:00:00.000000000 Z
+date: 2026-05-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core-plugin-api
@@ -468,7 +468,7 @@ files:
 - spec/unit/inputs/common_spec.rb
 - spec/unit/inputs/snmp_spec.rb
 - spec/unit/inputs/snmptrap_spec.rb
-- vendor/jar-dependencies/org/logstash/integrations/plugin/4.2.2/plugin-4.2.2.jar
+- vendor/jar-dependencies/org/logstash/integrations/plugin/4.3.1/plugin-4.3.1.jar
 - vendor/jar-dependencies/org/snakeyaml/snakeyaml-engine/2.7/snakeyaml-engine-2.7.jar
 - vendor/jar-dependencies/org/snmp4j/snmp4j-log4j/2.8.11/snmp4j-log4j-2.8.11.jar
 - vendor/jar-dependencies/org/snmp4j/snmp4j/3.8.0/snmp4j-3.8.0.jar