Snmp_trap input split field to fields

Telegraf
1

Hi!

I’m using telegraf snmp_trap input and there is a alarmTextT.1 oid which contains lot of information which I would like to separete into fields. Here is a sample:
alarmTextT.1=“aty=ETH|stn=IP mcast 1 2|sta=238.1.3.50|stp=1234|vla=0|ifa=eth0|ssm=0.0.0.0|aid=1420|loc=|MLR >= error-threshold (23 >= 8)”
I want to separe it by | symbol. I tried the split processor plugin but it did work, and I don’t think it’s the correct plugin to use. Is there a plugin which with could do the splitting?

2

@laces86 Welcome to the InfluxData Community!

To extract specific values from your alarmTextT.1 field, the regex processor plugin is the ideal tool.

Here’s an example configuration that parses your alarm string into individual fields:

[[processors.regex]]
  namepass = ["snmp_trap"]
  
  [[processors.regex.fields]]
    key = "alarmTextT_1"
    pattern = "aty=(?P<alarm_type>[^|]+)\\|stn=(?P<station>[^|]+)\\|sta=(?P<station_address>[^|]+)\\|stp=(?P<station_port>[^|]+)\\|vla=(?P<vlan>[^|]+)\\|ifa=(?P<interface>[^|]+)\\|ssm=(?P<ssm_address>[^|]+)\\|aid=(?P<alarm_id>[^|]+)\\|loc=(?P<location>[^|]*)\\|(?P<alarm_description>.*)"

Input:

alarmTextT.1="aty=ETH|stn=IP mcast 1 2|sta=238.1.3.50|stp=1234|vla=0|ifa=eth0|ssm=0.0.0.0|aid=1420|loc=|MLR >= error-threshold (23 >= 8)"

Output Fields:

  • alarm_type: ETH
  • station: IP mcast 1 2
  • station_address: 238.1.3.50
  • station_port: 1234
  • vlan: 0
  • interface: eth0
  • ssm_address: 0.0.0.0
  • alarm_id: 1420
  • location: (empty)
  • alarm_description: MLR >= error-threshold (23 >= 8)

This lets you break down a structured alarm message into usable fields for filtering, querying, or alerting within Telegraf and beyond. Let us know if you need help adjusting the pattern or handling variations!