logstash/logstash — pull request #394 by rasputnik (2013-03-08 10:32:51+00:00)
Title: extract string from SNMP trap as strings

Current @message is generated by inspect, so it's full of object addresses which are ungrokable.

This patch sets the message to "name1=val1\nname2=val2\n" etc. so a simple kv filter can
extract them.

(

is it better to apply that data as top-level fields on event itself?

i.e. event[name1] = val and so on?

If so I'm not sure what to set as a meaningful @message

)