# SNMP Trap Input - snmp fields not useable in pipeline rules

**URL:** <https://community.graylog.org/t/snmp-trap-input-snmp-fields-not-useable-in-pipeline-rules/13409>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [January 9, 2020, 11:47am UTC](https://community.graylog.org/t/snmp-trap-input-snmp-fields-not-useable-in-pipeline-rules/13409 "2020-01-09T11:47:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![HansWurst](https://avatars.discourse-cdn.com/v4/letter/h/839c29/32.png) [@HansWurst](https://community.graylog.org/u/HansWurst)\
**Post date:** [January 9, 2020, 11:47am UTC](https://community.graylog.org/t/snmp-trap-input-snmp-fields-not-useable-in-pipeline-rules/13409/1 "2020-01-09T11:47:00Z")

</div>

Hello,

I am using the SNMP Trap Input from marketplace. Now I try to use fields from Trap in pipeline rules, but they are always empty.

No MIB file is used, so each message contains fields with snmp oids. For example oid 1.2.3 will be shown as field snmp\_1\_2\_3. In search field, I see that field snmp\_1\_2\_3 has a value. Field test\_1 has value “ok”, so I know this rule fires. But field test\_2 is empty / not set.

Using has\_field(snmp\_1\_2\_3) in when clause does also not work.

```
rule "test"
when
    true
then
    set_field("test_1", "ok");
    set_field("test_2", to_string($message.snmp_1_2_3));
end

```

Any ideas? THe Guthub projects seems not maintained and I dont have the skills to fix java code by myself.

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [January 9, 2020, 1:14pm UTC](https://community.graylog.org/t/snmp-trap-input-snmp-fields-not-useable-in-pipeline-rules/13409/2 "2020-01-09T13:14:36Z")

</div>

If I were you, I would rather use:

1. Either logstash with snmptrap input plugin and send output to graylog  
[https://www.elastic.co/guide/en/logstash/current/plugins-inputs-snmptrap.html](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-snmptrap.html)
2. Or another tool, that is better capable of mange snmp-traps, some NMS like Zabbix, Iginca for example.

---

<div class="post-metadata">

**Author:** ![HansWurst](https://avatars.discourse-cdn.com/v4/letter/h/839c29/32.png) [@HansWurst](https://community.graylog.org/u/HansWurst)\
**Post date:** [January 9, 2020, 1:34pm UTC](https://community.graylog.org/t/snmp-trap-input-snmp-fields-not-useable-in-pipeline-rules/13409/3 "2020-01-09T13:34:05Z")

</div>

Yes, logstash with snmp trap input and gelf output to graylog…  
That sounds like a very good idea - thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 23, 2020, 1:34pm UTC](https://community.graylog.org/t/snmp-trap-input-snmp-fields-not-useable-in-pipeline-rules/13409/4 "2020-01-23T13:34:09Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.