diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 85364d081e6..05390b38f8c 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -336,6 +336,7 @@
/packages/nagios_xi @elastic/obs-infraobs-integrations
/packages/nats @elastic/obs-infraobs-integrations
/packages/neon_cyber @elastic/security-service-integrations
+/packages/netbox @elastic/obs-infraobs-integrations
/packages/netflow @elastic/integration-experience
/packages/netscout @elastic/integration-experience
/packages/netskope @elastic/security-service-integrations
diff --git a/packages/netbox/LICENSE.txt b/packages/netbox/LICENSE.txt
new file mode 100644
index 00000000000..809108b857f
--- /dev/null
+++ b/packages/netbox/LICENSE.txt
@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.
diff --git a/packages/netbox/_dev/build/build.yml b/packages/netbox/_dev/build/build.yml
new file mode 100644
index 00000000000..e2b012548e0
--- /dev/null
+++ b/packages/netbox/_dev/build/build.yml
@@ -0,0 +1,3 @@
+dependencies:
+ ecs:
+ reference: git@v8.11.0
diff --git a/packages/netbox/_dev/build/docs/README.md b/packages/netbox/_dev/build/docs/README.md
new file mode 100644
index 00000000000..b7947b98755
--- /dev/null
+++ b/packages/netbox/_dev/build/docs/README.md
@@ -0,0 +1,29 @@
+# NetBox Integration
+
+This integration is for [NetBox](). It currently supports retrieving devices and ip addresses from the NetBox API.
+
+## Setup
+
+Retrieve an [API token](https://netboxlabs.com/docs/netbox/integrations/rest-api/#initial-token-provisioning) from your NetBox Server and update the URL to your NetBox Server.
+
+## Compatibility
+
+The NetBox module has been developed with and tested against the [community edition](https://github.com/netbox-community/netbox) version 4.3.5
+
+## Logs
+
+### Devices
+
+Collects devices from the [Devices API](https://demo.netbox.dev/api/schema/swagger-ui/#/dcim/dcim_devices_list).
+
+{{event "devices"}}
+
+{{fields "devices"}}
+
+### IPs
+
+Collects IP addresses from the [IP Addresses API](https://demo.netbox.dev/api/schema/swagger-ui/#/ipam/ipam_ip_addresses_list).
+
+{{event "ips"}}
+
+{{fields "ips"}}
diff --git a/packages/netbox/_dev/deploy/docker/config.yml b/packages/netbox/_dev/deploy/docker/config.yml
new file mode 100644
index 00000000000..50a6d48ac04
--- /dev/null
+++ b/packages/netbox/_dev/deploy/docker/config.yml
@@ -0,0 +1,878 @@
+rules:
+ - path: /api/dcim/devices
+ methods: ["GET"]
+ query_params:
+ limit: "2"
+ offset: "2"
+ request_headers:
+ Content-Type:
+ - "application/json"
+ Authorization:
+ - "Token --token--"
+ responses:
+ - status_code: 200
+ headers:
+ Content-Type:
+ - "application/json; charset=utf-8"
+ body: |-
+ {
+ "count": 1,
+ "next": null,
+ "previous": null,
+ "results": [
+ {
+ "id": 3,
+ "url": "http://localhost:8000/api/dcim/devices/3/",
+ "display_url": "http://localhost:8000/dcim/devices/3/",
+ "display": "web-srv-02 (WEB-002)",
+ "name": "web-srv-02",
+ "device_type": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/device-types/1/",
+ "display": "dell poweredge r740",
+ "manufacturer": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/manufacturers/1/",
+ "display": "Dell",
+ "name": "Dell",
+ "slug": "dell",
+ "description": ""
+ },
+ "model": "poweredge r740",
+ "slug": "poweredge-r740",
+ "description": "Dell PowerEdge R740 2U Rack Server"
+ },
+ "role": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/device-roles/1/",
+ "display": "web-server",
+ "name": "web-server",
+ "slug": "web-server",
+ "description": "",
+ "_depth": 0
+ },
+ "tenant": {
+ "id": 1,
+ "url": "http://localhost:8000/api/tenancy/tenants/1/",
+ "display": "acme-corp",
+ "name": "acme-corp",
+ "slug": "acme-corp",
+ "description": "Acme Corporation primary tenant"
+ },
+ "platform": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/platforms/1/",
+ "display": "ubuntu-server",
+ "name": "ubuntu-server",
+ "slug": "ubuntu-server",
+ "description": "Ubuntu Server 22.04 LTS"
+ },
+ "serial": "CN7016A2B90002",
+ "asset_tag": "WEB-002",
+ "site": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/sites/1/",
+ "display": "datacenter-east",
+ "name": "datacenter-east",
+ "slug": "datacenter-east",
+ "description": ""
+ },
+ "location": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/locations/1/",
+ "display": "server-room-a",
+ "name": "server-room-a",
+ "slug": "server-room-a",
+ "description": "Primary server room - Zone A",
+ "rack_count": 0,
+ "_depth": 0
+ },
+ "rack": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/racks/1/",
+ "display": "rack-a01 (DC-EAST-A01)",
+ "name": "rack-a01",
+ "description": "42U server rack - Zone A, Row 1"
+ },
+ "position": 15.0,
+ "face": {
+ "value": "front",
+ "label": "Front"
+ },
+ "latitude": 39.0458,
+ "longitude": -76.6413,
+ "parent_device": null,
+ "status": {
+ "value": "active",
+ "label": "Active"
+ },
+ "airflow": {
+ "value": "front-to-rear",
+ "label": "Front to rear"
+ },
+ "primary_ip": {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/",
+ "display": "10.0.1.15/24",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "10.0.1.15/24",
+ "description": "Primary web server interface"
+ },
+ "primary_ip4": {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/",
+ "display": "10.0.1.15/24",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "10.0.1.15/24",
+ "description": "Primary web server interface"
+ },
+ "primary_ip6": null,
+ "oob_ip": {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/",
+ "display": "10.0.100.15/24",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "10.0.100.15/24",
+ "description": "Out-of-band management interface"
+ },
+ "cluster": {
+ "id": 1,
+ "url": "http://localhost:8000/api/virtualization/clusters/1/",
+ "display": "web-cluster",
+ "name": "web-cluster",
+ "description": "Production web application cluster"
+ },
+ "virtual_chassis": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/virtual-chassis/1/",
+ "display": "web-cluster-vc",
+ "name": "web-cluster-vc",
+ "master": {
+ "id": 2,
+ "url": "http://localhost:8000/api/dcim/devices/2/",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "display": "web-srv-01 (WEB-001)",
+ "name": "web-srv-01"
+ },
+ "description": "",
+ "member_count": 2
+ },
+ "vc_position": 1,
+ "vc_priority": null,
+ "description": "Primary web server for customer portal",
+ "comments": "",
+ "config_template": {
+ "id": 1,
+ "url": "http://localhost:8000/api/extras/config-templates/1/",
+ "display": "ubuntu-web-template",
+ "name": "ubuntu-web-template",
+ "description": "Standard Ubuntu web server configuration template"
+ },
+ "config_context": {
+ "environment": "production",
+ "backup_enabled": true
+ },
+ "local_context_data": {
+ "monitoring": "enabled",
+ "ssl_cert": "wildcard.acme.com"
+ },
+ "tags": [
+ {
+ "id": 2,
+ "url": "http://localhost:8000/api/extras/tags/2/",
+ "display_url": "http://localhost:8000/extras/tags/2/",
+ "display": "production",
+ "name": "production",
+ "slug": "production",
+ "color": "4caf50"
+ },
+ {
+ "id": 4,
+ "url": "http://localhost:8000/api/extras/tags/4/",
+ "display_url": "http://localhost:8000/extras/tags/4/",
+ "display": "web-tier",
+ "name": "web-tier",
+ "slug": "web-tier",
+ "color": "2196f3"
+ },
+ {
+ "id": 1,
+ "url": "http://localhost:8000/api/extras/tags/1/",
+ "display_url": "http://localhost:8000/extras/tags/1/",
+ "display": "critical",
+ "name": "critical",
+ "slug": "critical",
+ "color": "f44336"
+ },
+ {
+ "id": 3,
+ "url": "http://localhost:8000/api/extras/tags/3/",
+ "display_url": "http://localhost:8000/extras/tags/3/",
+ "display": "monitored",
+ "name": "monitored",
+ "slug": "monitored",
+ "color": "ff9800"
+ }
+ ],
+ "custom_fields": {
+ "maintenance_window": "Sunday 02:00-04:00 EST"
+ },
+ "created": "2025-08-11T14:37:28.180540Z",
+ "last_updated": "2025-08-11T18:12:23.512163Z",
+ "console_port_count": 0,
+ "console_server_port_count": 0,
+ "power_port_count": 2,
+ "power_outlet_count": 0,
+ "interface_count": 4,
+ "front_port_count": 0,
+ "rear_port_count": 0,
+ "device_bay_count": 0,
+ "module_bay_count": 0,
+ "inventory_item_count": 0
+ }
+ ]
+ }
+ - path: /api/dcim/devices
+ methods: ["GET"]
+ query_params:
+ limit: "2"
+ request_headers:
+ Content-Type:
+ - "application/json"
+ Authorization:
+ - "Token --token--"
+ responses:
+ - status_code: 200
+ headers:
+ Content-Type:
+ - "application/json; charset=utf-8"
+ body: |-
+ {
+ "count": 2,
+ "next": "http://svc-netbox_mock:8080/api/dcim/devices?limit=2&offset=2",
+ "previous": null,
+ "results": [
+ {
+ "id": 2,
+ "url": "http://localhost:8000/api/dcim/devices/2/",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "display": "web-srv-01 (WEB-001)",
+ "name": "web-srv-01",
+ "device_type": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/device-types/1/",
+ "display": "dell poweredge r740",
+ "manufacturer": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/manufacturers/1/",
+ "display": "Dell",
+ "name": "Dell",
+ "slug": "dell",
+ "description": ""
+ },
+ "model": "poweredge r740",
+ "slug": "poweredge-r740",
+ "description": "Dell PowerEdge R740 2U Rack Server"
+ },
+ "role": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/device-roles/1/",
+ "display": "web-server",
+ "name": "web-server",
+ "slug": "web-server",
+ "description": "",
+ "_depth": 0
+ },
+ "tenant": {
+ "id": 1,
+ "url": "http://localhost:8000/api/tenancy/tenants/1/",
+ "display": "acme-corp",
+ "name": "acme-corp",
+ "slug": "acme-corp",
+ "description": "Acme Corporation primary tenant"
+ },
+ "platform": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/platforms/1/",
+ "display": "ubuntu-server",
+ "name": "ubuntu-server",
+ "slug": "ubuntu-server",
+ "description": "Ubuntu Server 22.04 LTS"
+ },
+ "serial": "CN7016A2B90001",
+ "asset_tag": "WEB-001",
+ "site": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/sites/1/",
+ "display": "datacenter-east",
+ "name": "datacenter-east",
+ "slug": "datacenter-east",
+ "description": ""
+ },
+ "location": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/locations/1/",
+ "display": "server-room-a",
+ "name": "server-room-a",
+ "slug": "server-room-a",
+ "description": "Primary server room - Zone A",
+ "rack_count": 0,
+ "_depth": 0
+ },
+ "rack": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/racks/1/",
+ "display": "rack-a01 (DC-EAST-A01)",
+ "name": "rack-a01",
+ "description": "42U server rack - Zone A, Row 1"
+ },
+ "position": 15.0,
+ "face": {
+ "value": "front",
+ "label": "Front"
+ },
+ "latitude": 39.0458,
+ "longitude": -76.6413,
+ "parent_device": null,
+ "status": {
+ "value": "active",
+ "label": "Active"
+ },
+ "airflow": {
+ "value": "front-to-rear",
+ "label": "Front to rear"
+ },
+ "primary_ip": {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/",
+ "display": "10.0.1.15/24",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "10.0.1.15/24",
+ "description": "Primary web server interface"
+ },
+ "primary_ip4": {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/",
+ "display": "10.0.1.15/24",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "10.0.1.15/24",
+ "description": "Primary web server interface"
+ },
+ "primary_ip6": null,
+ "oob_ip": {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/",
+ "display": "10.0.100.15/24",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "10.0.100.15/24",
+ "description": "Out-of-band management interface"
+ },
+ "cluster": {
+ "id": 1,
+ "url": "http://localhost:8000/api/virtualization/clusters/1/",
+ "display": "web-cluster",
+ "name": "web-cluster",
+ "description": "Production web application cluster"
+ },
+ "virtual_chassis": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/virtual-chassis/1/",
+ "display": "web-cluster-vc",
+ "name": "web-cluster-vc",
+ "master": {
+ "id": 2,
+ "url": "http://localhost:8000/api/dcim/devices/2/",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "display": "web-srv-01 (WEB-001)",
+ "name": "web-srv-01"
+ },
+ "description": "",
+ "member_count": 2
+ },
+ "vc_position": 1,
+ "vc_priority": null,
+ "description": "Primary web server for customer portal",
+ "comments": "",
+ "config_template": {
+ "id": 1,
+ "url": "http://localhost:8000/api/extras/config-templates/1/",
+ "display": "ubuntu-web-template",
+ "name": "ubuntu-web-template",
+ "description": "Standard Ubuntu web server configuration template"
+ },
+ "config_context": {
+ "environment": "production",
+ "backup_enabled": true
+ },
+ "local_context_data": {
+ "monitoring": "enabled",
+ "ssl_cert": "wildcard.acme.com"
+ },
+ "tags": [
+ {
+ "id": 2,
+ "url": "http://localhost:8000/api/extras/tags/2/",
+ "display_url": "http://localhost:8000/extras/tags/2/",
+ "display": "production",
+ "name": "production",
+ "slug": "production",
+ "color": "4caf50"
+ },
+ {
+ "id": 4,
+ "url": "http://localhost:8000/api/extras/tags/4/",
+ "display_url": "http://localhost:8000/extras/tags/4/",
+ "display": "web-tier",
+ "name": "web-tier",
+ "slug": "web-tier",
+ "color": "2196f3"
+ },
+ {
+ "id": 1,
+ "url": "http://localhost:8000/api/extras/tags/1/",
+ "display_url": "http://localhost:8000/extras/tags/1/",
+ "display": "critical",
+ "name": "critical",
+ "slug": "critical",
+ "color": "f44336"
+ },
+ {
+ "id": 3,
+ "url": "http://localhost:8000/api/extras/tags/3/",
+ "display_url": "http://localhost:8000/extras/tags/3/",
+ "display": "monitored",
+ "name": "monitored",
+ "slug": "monitored",
+ "color": "ff9800"
+ }
+ ],
+ "custom_fields": {
+ "maintenance_window": "Sunday 02:00-04:00 EST"
+ },
+ "created": "2025-08-11T14:37:28.180540Z",
+ "last_updated": "2025-08-11T18:12:23.512163Z",
+ "console_port_count": 0,
+ "console_server_port_count": 0,
+ "power_port_count": 2,
+ "power_outlet_count": 0,
+ "interface_count": 4,
+ "front_port_count": 0,
+ "rear_port_count": 0,
+ "device_bay_count": 0,
+ "module_bay_count": 0,
+ "inventory_item_count": 0
+ },
+ {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/devices/1/",
+ "display_url": "http://localhost:8000/dcim/devices/1/",
+ "display": "db-srv-01 (DB-001)",
+ "name": "db-srv-01",
+ "device_type": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/device-types/1/",
+ "display": "dell poweredge r740",
+ "manufacturer": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/manufacturers/1/",
+ "display": "Dell",
+ "name": "Dell",
+ "slug": "dell",
+ "description": ""
+ },
+ "model": "poweredge r740",
+ "slug": "poweredge-r740",
+ "description": "Dell PowerEdge R740 2U Rack Server"
+ },
+ "role": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/device-roles/1/",
+ "display": "database-server",
+ "name": "database-server",
+ "slug": "database-server",
+ "description": "",
+ "_depth": 0
+ },
+ "tenant": {
+ "id": 1,
+ "url": "http://localhost:8000/api/tenancy/tenants/1/",
+ "display": "acme-corp",
+ "name": "acme-corp",
+ "slug": "acme-corp",
+ "description": "Acme Corporation primary tenant"
+ },
+ "platform": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/platforms/1/",
+ "display": "rhel-server",
+ "name": "rhel-server",
+ "slug": "rhel-server",
+ "description": "Red Hat Enterprise Linux 9"
+ },
+ "serial": "CN7016A2B90002",
+ "asset_tag": "DB-001",
+ "site": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/sites/1/",
+ "display": "datacenter-east",
+ "name": "datacenter-east",
+ "slug": "datacenter-east",
+ "description": ""
+ },
+ "location": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/locations/1/",
+ "display": "server-room-b",
+ "name": "server-room-b",
+ "slug": "server-room-b",
+ "description": "Secure server room - Zone B",
+ "rack_count": 0,
+ "_depth": 0
+ },
+ "rack": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/racks/1/",
+ "display": "rack-b03 (DC-EAST-B03)",
+ "name": "rack-b03",
+ "description": "42U server rack - Zone B, Row 3"
+ },
+ "position": 20.0,
+ "face": {
+ "value": "front",
+ "label": "Front"
+ },
+ "latitude": 39.0463,
+ "longitude": -76.6418,
+ "parent_device": null,
+ "status": {
+ "value": "active",
+ "label": "Active"
+ },
+ "airflow": {
+ "value": "front-to-rear",
+ "label": "Front to rear"
+ },
+ "primary_ip": {
+ "id": 2,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/2/",
+ "display": "10.0.2.20/24",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "10.0.2.20/24",
+ "description": "Primary database server interface"
+ },
+ "primary_ip4": {
+ "id": 2,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/2/",
+ "display": "10.0.2.20/24",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "10.0.2.20/24",
+ "description": "Primary database server interface"
+ },
+ "primary_ip6": null,
+ "oob_ip": {
+ "id": 2,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/2/",
+ "display": "10.0.100.20/24",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "10.0.100.20/24",
+ "description": "Out-of-band management interface"
+ },
+ "cluster": {
+ "id": 1,
+ "url": "http://localhost:8000/api/virtualization/clusters/1/",
+ "display": "database-cluster",
+ "name": "database-cluster",
+ "description": "Production PostgreSQL cluster"
+ },
+ "virtual_chassis": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/virtual-chassis/1/",
+ "display": "db-cluster-vc",
+ "name": "db-cluster-vc",
+ "master": {
+ "id": 2,
+ "url": "http://localhost:8000/api/dcim/devices/2/",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "display": "web-srv-01 (WEB-001)",
+ "name": "web-srv-01"
+ },
+ "description": "",
+ "member_count": 2
+ },
+ "vc_position": 2,
+ "vc_priority": 1,
+ "description": "Primary PostgreSQL database server",
+ "comments": "Configured for high availability with automated backups",
+ "config_template": null,
+ "config_context": {},
+ "local_context_data": null,
+ "tags": [
+ {
+ "id": 2,
+ "url": "http://localhost:8000/api/extras/tags/2/",
+ "display_url": "http://localhost:8000/extras/tags/2/",
+ "display": "production",
+ "name": "production",
+ "slug": "production",
+ "color": "4caf50"
+ }
+ ],
+ "custom_fields": {
+ "backup_schedule": "Daily 01:00 EST, Weekly Sunday 23:00 EST"
+ },
+ "created": "2025-08-11T14:26:04.132249Z",
+ "last_updated": "2025-08-11T19:06:27.330706Z",
+ "console_port_count": 0,
+ "console_server_port_count": 0,
+ "power_port_count": 2,
+ "power_outlet_count": 0,
+ "interface_count": 4,
+ "front_port_count": 0,
+ "rear_port_count": 0,
+ "device_bay_count": 0,
+ "module_bay_count": 0,
+ "inventory_item_count": 0
+ }
+ ]
+ }
+ - path: /api/ipam/ip-addresses
+ methods: ["GET"]
+ query_params:
+ limit: "1"
+ offset: "1"
+ request_headers:
+ Content-Type:
+ - "application/json"
+ Authorization:
+ - "Token --token--"
+ responses:
+ - status_code: 200
+ headers:
+ Content-Type:
+ - "application/json; charset=utf-8"
+ body: |-
+ {
+ "count": 1,
+ "next": null,
+ "previous": null,
+ "results": [
+ {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/",
+ "display_url": "http://localhost:8000/ipam/ip-addresses/1/",
+ "display": "192.168.1.100/32",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "192.168.1.100/32",
+ "vrf": {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/vrfs/1/",
+ "display": "test",
+ "name": "test",
+ "rd": null,
+ "description": "desc"
+ },
+ "tenant": {
+ "id": 1,
+ "url": "http://localhost:8000/api/tenancy/tenants/1/",
+ "display": "tenant-1",
+ "name": "tenant-1",
+ "slug": "tenant-1",
+ "description": "first tenant"
+ },
+ "status": {
+ "value": "active",
+ "label": "Active"
+ },
+ "role": {
+ "value": "secondary",
+ "label": "Secondary"
+ },
+ "assigned_object_type": "dcim.interface",
+ "assigned_object_id": 1,
+ "assigned_object": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/interfaces/1/",
+ "display": "test1",
+ "device": {
+ "id": 2,
+ "url": "http://localhost:8000/api/dcim/devices/2/",
+ "display": "server-1 (server)",
+ "name": "server-1",
+ "description": "test server"
+ },
+ "name": "test1",
+ "description": "wlan",
+ "cable": null,
+ "_occupied": false
+ },
+ "nat_inside": {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/",
+ "display_url": "http://localhost:8000/ipam/ip-addresses/1/",
+ "display": "192.168.1.100/32",
+ "family": 4,
+ "address": "192.168.1.100/32"
+ },
+ "nat_outside": [
+ {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/",
+ "display_url": "http://localhost:8000/ipam/ip-addresses/1/",
+ "display": "192.168.1.100/32",
+ "family": 4,
+ "address": "192.168.1.100/32"
+ }
+ ],
+ "dns_name": "test.co",
+ "description": "desc",
+ "comments": "",
+ "tags": [
+ {
+ "id": 2,
+ "url": "http://localhost:8000/api/extras/tags/2/",
+ "display_url": "http://localhost:8000/extras/tags/2/",
+ "display": "dev",
+ "name": "dev",
+ "slug": "dev",
+ "color": "9e9e9e"
+ },
+ {
+ "id": 3,
+ "url": "http://localhost:8000/api/extras/tags/3/",
+ "display_url": "http://localhost:8000/extras/tags/3/",
+ "display": "web",
+ "name": "web",
+ "slug": "web",
+ "color": "9e9e9e"
+ }
+ ],
+ "custom_fields": {},
+ "created": "2025-08-11T16:49:52.511883Z",
+ "last_updated": "2025-08-12T12:50:29.063329Z"
+ }
+ ]
+ }
+ - path: /api/ipam/ip-addresses
+ methods: ["GET"]
+ query_params:
+ limit: "1"
+ request_headers:
+ Content-Type:
+ - "application/json"
+ Authorization:
+ - "Token --token--"
+ responses:
+ - status_code: 200
+ headers:
+ Content-Type:
+ - "application/json; charset=utf-8"
+ body: |-
+ {
+ "count": 1,
+ "next": "http://svc-netbox_mock:8080/api/ipam/ip-addresses?limit=1&offset=1",
+ "previous": null,
+ "results": [
+ {
+ "id": 2,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/2/",
+ "display_url": "http://localhost:8000/ipam/ip-addresses/2/",
+ "display": "192.168.1.101/32",
+ "family": {
+ "value": 4,
+ "label": "IPv4"
+ },
+ "address": "192.168.1.101/32",
+ "vrf": {
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/vrfs/1/",
+ "display": "test",
+ "name": "test",
+ "rd": null,
+ "description": "asdf"
+ },
+ "tenant": {
+ "id": 1,
+ "url": "http://localhost:8000/api/tenancy/tenants/1/",
+ "display": "tenant-1",
+ "name": "tenant-1",
+ "slug": "tenant-1",
+ "description": "first tenant"
+ },
+ "status": {
+ "value": "active",
+ "label": "Active"
+ },
+ "role": {
+ "value": "secondary",
+ "label": "Secondary"
+ },
+ "assigned_object_type": "dcim.interface",
+ "assigned_object_id": 2,
+ "assigned_object": {
+ "id": 2,
+ "url": "http://localhost:8000/api/dcim/interfaces/2/",
+ "display": "hello",
+ "device": {
+ "id": 1,
+ "url": "http://localhost:8000/api/dcim/devices/1/",
+ "display": "user-1-macbook-pro (tag-1234)",
+ "name": "user-1-macbook-pro",
+ "description": "test-description"
+ },
+ "name": "user-hello",
+ "description": "test-description",
+ "cable": null,
+ "_occupied": false
+ },
+ "nat_inside": null,
+ "nat_outside": [],
+ "dns_name": "hello.world",
+ "description": "desc",
+ "comments": "",
+ "tags": [
+ {
+ "id": 4,
+ "url": "http://localhost:8000/api/extras/tags/4/",
+ "display_url": "http://localhost:8000/extras/tags/4/",
+ "display": "elastic",
+ "name": "elastic",
+ "slug": "elastic",
+ "color": "ff9800"
+ }
+ ],
+ "custom_fields": {},
+ "created": "2025-08-11T18:07:04.795476Z",
+ "last_updated": "2025-08-11T18:07:04.795486Z"
+ }
+ ]
+ }
diff --git a/packages/netbox/_dev/deploy/docker/docker-compose.yml b/packages/netbox/_dev/deploy/docker/docker-compose.yml
new file mode 100644
index 00000000000..19442cdd9c1
--- /dev/null
+++ b/packages/netbox/_dev/deploy/docker/docker-compose.yml
@@ -0,0 +1,15 @@
+version: '3.0'
+services:
+ netbox_mock:
+ image: docker.elastic.co/observability/stream:v0.18.0
+ hostname: netbox_mock
+ ports:
+ - 8080
+ volumes:
+ - ./config.yml:/config.yml
+ environment:
+ PORT: "8080"
+ command:
+ - http-server
+ - --addr=:8080
+ - --config=/config.yml
diff --git a/packages/netbox/changelog.yml b/packages/netbox/changelog.yml
new file mode 100644
index 00000000000..4bcb69883f7
--- /dev/null
+++ b/packages/netbox/changelog.yml
@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.0.1"
+ changes:
+ - description: Initial draft of the package
+ type: enhancement
+ link: https://github.com/elastic/integrations/pull/14949
diff --git a/packages/netbox/data_stream/devices/_dev/test/pipeline/test-devices.json b/packages/netbox/data_stream/devices/_dev/test/pipeline/test-devices.json
new file mode 100644
index 00000000000..80e909ef81a
--- /dev/null
+++ b/packages/netbox/data_stream/devices/_dev/test/pipeline/test-devices.json
@@ -0,0 +1,12 @@
+{
+ "events": [
+ {
+ "@timestamp": "2022-10-24T21:16:62.827288935Z",
+ "message": "{\"id\": 2,\"url\": \"http://localhost:8000/api/dcim/devices/2/\",\"display_url\": \"http://localhost:8000/dcim/devices/2/\",\"display\": \"server-1 (macbook-server)\",\"name\": \"server-1\",\"device_type\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/device-types/1/\",\"display\": \"macbook pro\",\"manufacturer\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/manufacturers/1/\",\"display\": \"Apple\",\"name\": \"Apple\",\"slug\": \"apple\",\"description\": \"\"},\"model\": \"macbook pro\",\"slug\": \"macbook-pro\",\"description\": \"Macbook Pro\"},\"role\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/device-roles/1/\",\"display\": \"test-role\",\"name\": \"test-role\",\"slug\": \"test-role\",\"description\": \"\",\"_depth\": 0},\"tenant\": {\"id\": 1,\"url\": \"http://localhost:8000/api/tenancy/tenants/1/\",\"display\": \"tenant-1\",\"name\": \"tenant-1\",\"slug\": \"tenant-1\",\"description\": \"first tenant\"},\"platform\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/platforms/1/\",\"display\": \"some-playtofmr\",\"name\": \"some-playtofmr\",\"slug\": \"some-playtofmr\",\"description\": \"6trgyuhb\"},\"serial\": \"243rtgtbsasdf\",\"asset_tag\": \"macbook-server\",\"site\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/sites/1/\",\"display\": \"test-site\",\"name\": \"test-site\",\"slug\": \"test-site\",\"description\": \"\"},\"location\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/locations/1/\",\"display\": \"location1\",\"name\": \"location1\",\"slug\": \"location1\",\"description\": \"some location\",\"rack_count\": 0,\"_depth\": 0},\"rack\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/racks/1/\",\"display\": \"rack-1 (faciclity-id-123)\",\"name\": \"rack-1\",\"description\": \"test rack 1\"},\"position\": 1.0,\"face\": {\"value\": \"front\",\"label\": \"Front\"},\"latitude\": 4e-06,\"longitude\": 5e-06,\"parent_device\": null,\"status\": {\"value\": \"active\",\"label\": \"Active\"},\"airflow\": {\"value\": \"front-to-rear\",\"label\": \"Front to rear\"},\"primary_ip\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/24\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"great desc\"},\"primary_ip4\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/24\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"great desc\"},\"primary_ip6\": null,\"oob_ip\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/24\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"great desc\"},\"cluster\": {\"id\": 1,\"url\": \"http://localhost:8000/api/virtualization/clusters/1/\",\"display\": \"test\",\"name\": \"test\",\"description\": \"test-description\"},\"virtual_chassis\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/virtual-chassis/1/\",\"display\": \"asdf\",\"name\": \"asdf\",\"master\": {\"id\": 2,\"url\": \"http://localhost:8000/api/dcim/devices/2/\",\"display_url\": \"http://localhost:8000/dcim/devices/2/\",\"display\": \"server-1 (macbook-server)\",\"name\": \"server-1\"},\"description\": \"\",\"member_count\": 2},\"vc_position\": 1,\"vc_priority\": null,\"description\": \"test server\",\"comments\": \"\",\"config_template\": {\"id\": 1,\"url\": \"http://localhost:8000/api/extras/config-templates/1/\",\"display\": \"test\",\"name\": \"test\",\"description\": \"asdf\"},\"config_context\": {\"hello\": \"world\"},\"local_context_data\": {\"hello\": \"world\"},\"tags\": [{\"id\": 2,\"url\": \"http://localhost:8000/api/extras/tags/2/\",\"display_url\": \"http://localhost:8000/extras/tags/2/\",\"display\": \"dev\",\"name\": \"dev\",\"slug\": \"dev\",\"color\": \"9e9e9e\"},{\"id\": 4,\"url\": \"http://localhost:8000/api/extras/tags/4/\",\"display_url\": \"http://localhost:8000/extras/tags/4/\",\"display\": \"elastic\",\"name\": \"elastic\",\"slug\": \"elastic\",\"color\": \"ff9800\"},{\"id\": 1,\"url\": \"http://localhost:8000/api/extras/tags/1/\",\"display_url\": \"http://localhost:8000/extras/tags/1/\",\"display\": \"prod\",\"name\": \"prod\",\"slug\": \"prod\",\"color\": \"9e9e9e\"},{\"id\": 3,\"url\": \"http://localhost:8000/api/extras/tags/3/\",\"display_url\": \"http://localhost:8000/extras/tags/3/\",\"display\": \"web\",\"name\": \"web\",\"slug\": \"web\",\"color\": \"9e9e9e\"}],\"custom_fields\": {\"test\": \"{'test': '5'}\"},\"created\": \"2025-08-11T14:37:28.180540Z\",\"last_updated\": \"2025-08-11T18:12:23.512163Z\",\"console_port_count\": 0,\"console_server_port_count\": 0,\"power_port_count\": 1,\"power_outlet_count\": 0,\"interface_count\": 1,\"front_port_count\": 0,\"rear_port_count\": 0,\"device_bay_count\": 0,\"module_bay_count\": 0,\"inventory_item_count\": 0}"
+ },
+ {
+ "@timestamp": "2022-10-24T21:16:62.827288935Z",
+ "message": "{\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/devices/1/\",\"display_url\": \"http://localhost:8000/dcim/devices/1/\",\"display\": \"user-1-macbook-pro (tag-1234)\",\"name\": \"user-1-macbook-pro\",\"device_type\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/device-types/1/\",\"display\": \"macbook pro\",\"manufacturer\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/manufacturers/1/\",\"display\": \"Apple\",\"name\": \"Apple\",\"slug\": \"apple\",\"description\": \"\"},\"model\": \"macbook pro\",\"slug\": \"macbook-pro\",\"description\": \"Macbook Pro\"},\"role\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/device-roles/1/\",\"display\": \"test-role\",\"name\": \"test-role\",\"slug\": \"test-role\",\"description\": \"\",\"_depth\": 0},\"tenant\": {\"id\": 1,\"url\": \"http://localhost:8000/api/tenancy/tenants/1/\",\"display\": \"tenant-1\",\"name\": \"tenant-1\",\"slug\": \"tenant-1\",\"description\": \"first tenant\"},\"platform\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/platforms/1/\",\"display\": \"some-playtofmr\",\"name\": \"some-playtofmr\",\"slug\": \"some-playtofmr\",\"description\": \"6trgyuhb\"},\"serial\": \"123345as3th23tr\",\"asset_tag\": \"tag-1234\",\"site\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/sites/1/\",\"display\": \"test-site\",\"name\": \"test-site\",\"slug\": \"test-site\",\"description\": \"\"},\"location\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/locations/1/\",\"display\": \"location1\",\"name\": \"location1\",\"slug\": \"location1\",\"description\": \"some location\",\"rack_count\": 0,\"_depth\": 0},\"rack\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/racks/1/\",\"display\": \"rack-1 (faciclity-id-123)\",\"name\": \"rack-1\",\"description\": \"test rack 1\"},\"position\": 2.0,\"face\": {\"value\": \"front\",\"label\": \"Front\"},\"latitude\": 1e-06,\"longitude\": 7e-06,\"parent_device\": null,\"status\": {\"value\": \"active\",\"label\": \"Active\"},\"airflow\": {\"value\": \"front-to-rear\",\"label\": \"Front to rear\"},\"primary_ip\": {\"id\": 2,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/2/\",\"display\": \"81.2.64.142/31\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"432rg\"},\"primary_ip4\": {\"id\": 2,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/2/\",\"display\": \"192.168.1.100/24\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"432rg\"},\"primary_ip6\": null,\"oob_ip\": {\"id\": 2,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/2/\",\"display\": \"192.168.1.100/24\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"432rg\"},\"cluster\": {\"id\": 1,\"url\": \"http://localhost:8000/api/virtualization/clusters/1/\",\"display\": \"test\",\"name\": \"test\",\"description\": \"test-description\"},\"virtual_chassis\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/virtual-chassis/1/\",\"display\": \"asdf\",\"name\": \"asdf\",\"master\": {\"id\": 2,\"url\": \"http://localhost:8000/api/dcim/devices/2/\",\"display_url\": \"http://localhost:8000/dcim/devices/2/\",\"display\": \"server-1 (macbook-server)\",\"name\": \"server-1\"},\"description\": \"\",\"member_count\": 2},\"vc_position\": 2,\"vc_priority\": 1,\"description\": \"test-description\",\"comments\": \"first comment\",\"config_template\": null,\"config_context\": {},\"local_context_data\": null,\"tags\": [{\"id\": 2,\"url\": \"http://localhost:8000/api/extras/tags/2/\",\"display_url\": \"http://localhost:8000/extras/tags/2/\",\"display\": \"dev\",\"name\": \"dev\",\"slug\": \"dev\",\"color\": \"9e9e9e\"}],\"custom_fields\": {\"test\": \"{'test': '5'}\"},\"created\": \"2025-08-11T14:26:04.132249Z\",\"last_updated\": \"2025-08-11T18:07:04.911893Z\",\"console_port_count\": 0,\"console_server_port_count\": 0,\"power_port_count\": 0,\"power_outlet_count\": 0,\"interface_count\": 1,\"front_port_count\": 0,\"rear_port_count\": 0,\"device_bay_count\": 0,\"module_bay_count\": 0,\"inventory_item_count\": 0}"
+ }
+ ]
+}
diff --git a/packages/netbox/data_stream/devices/_dev/test/pipeline/test-devices.json-config.yml b/packages/netbox/data_stream/devices/_dev/test/pipeline/test-devices.json-config.yml
new file mode 100644
index 00000000000..c58118a2420
--- /dev/null
+++ b/packages/netbox/data_stream/devices/_dev/test/pipeline/test-devices.json-config.yml
@@ -0,0 +1,4 @@
+fields:
+ "@timestamp": "2022-10-24T21:16:62.827288935Z"
+ tags:
+ - preserve_original_event
diff --git a/packages/netbox/data_stream/devices/_dev/test/pipeline/test-devices.json-expected.json b/packages/netbox/data_stream/devices/_dev/test/pipeline/test-devices.json-expected.json
new file mode 100644
index 00000000000..842f2035eae
--- /dev/null
+++ b/packages/netbox/data_stream/devices/_dev/test/pipeline/test-devices.json-expected.json
@@ -0,0 +1,434 @@
+{
+ "expected": [
+ {
+ "@timestamp": "2022-10-24T21:16:62.827288935Z",
+ "ecs": {
+ "version": "8.11.0"
+ },
+ "event": {
+ "category": [
+ "configuration"
+ ],
+ "kind": "asset",
+ "original": "{\"id\": 2,\"url\": \"http://localhost:8000/api/dcim/devices/2/\",\"display_url\": \"http://localhost:8000/dcim/devices/2/\",\"display\": \"server-1 (macbook-server)\",\"name\": \"server-1\",\"device_type\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/device-types/1/\",\"display\": \"macbook pro\",\"manufacturer\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/manufacturers/1/\",\"display\": \"Apple\",\"name\": \"Apple\",\"slug\": \"apple\",\"description\": \"\"},\"model\": \"macbook pro\",\"slug\": \"macbook-pro\",\"description\": \"Macbook Pro\"},\"role\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/device-roles/1/\",\"display\": \"test-role\",\"name\": \"test-role\",\"slug\": \"test-role\",\"description\": \"\",\"_depth\": 0},\"tenant\": {\"id\": 1,\"url\": \"http://localhost:8000/api/tenancy/tenants/1/\",\"display\": \"tenant-1\",\"name\": \"tenant-1\",\"slug\": \"tenant-1\",\"description\": \"first tenant\"},\"platform\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/platforms/1/\",\"display\": \"some-playtofmr\",\"name\": \"some-playtofmr\",\"slug\": \"some-playtofmr\",\"description\": \"6trgyuhb\"},\"serial\": \"243rtgtbsasdf\",\"asset_tag\": \"macbook-server\",\"site\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/sites/1/\",\"display\": \"test-site\",\"name\": \"test-site\",\"slug\": \"test-site\",\"description\": \"\"},\"location\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/locations/1/\",\"display\": \"location1\",\"name\": \"location1\",\"slug\": \"location1\",\"description\": \"some location\",\"rack_count\": 0,\"_depth\": 0},\"rack\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/racks/1/\",\"display\": \"rack-1 (faciclity-id-123)\",\"name\": \"rack-1\",\"description\": \"test rack 1\"},\"position\": 1.0,\"face\": {\"value\": \"front\",\"label\": \"Front\"},\"latitude\": 4e-06,\"longitude\": 5e-06,\"parent_device\": null,\"status\": {\"value\": \"active\",\"label\": \"Active\"},\"airflow\": {\"value\": \"front-to-rear\",\"label\": \"Front to rear\"},\"primary_ip\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/24\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"great desc\"},\"primary_ip4\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/24\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"great desc\"},\"primary_ip6\": null,\"oob_ip\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/24\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"great desc\"},\"cluster\": {\"id\": 1,\"url\": \"http://localhost:8000/api/virtualization/clusters/1/\",\"display\": \"test\",\"name\": \"test\",\"description\": \"test-description\"},\"virtual_chassis\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/virtual-chassis/1/\",\"display\": \"asdf\",\"name\": \"asdf\",\"master\": {\"id\": 2,\"url\": \"http://localhost:8000/api/dcim/devices/2/\",\"display_url\": \"http://localhost:8000/dcim/devices/2/\",\"display\": \"server-1 (macbook-server)\",\"name\": \"server-1\"},\"description\": \"\",\"member_count\": 2},\"vc_position\": 1,\"vc_priority\": null,\"description\": \"test server\",\"comments\": \"\",\"config_template\": {\"id\": 1,\"url\": \"http://localhost:8000/api/extras/config-templates/1/\",\"display\": \"test\",\"name\": \"test\",\"description\": \"asdf\"},\"config_context\": {\"hello\": \"world\"},\"local_context_data\": {\"hello\": \"world\"},\"tags\": [{\"id\": 2,\"url\": \"http://localhost:8000/api/extras/tags/2/\",\"display_url\": \"http://localhost:8000/extras/tags/2/\",\"display\": \"dev\",\"name\": \"dev\",\"slug\": \"dev\",\"color\": \"9e9e9e\"},{\"id\": 4,\"url\": \"http://localhost:8000/api/extras/tags/4/\",\"display_url\": \"http://localhost:8000/extras/tags/4/\",\"display\": \"elastic\",\"name\": \"elastic\",\"slug\": \"elastic\",\"color\": \"ff9800\"},{\"id\": 1,\"url\": \"http://localhost:8000/api/extras/tags/1/\",\"display_url\": \"http://localhost:8000/extras/tags/1/\",\"display\": \"prod\",\"name\": \"prod\",\"slug\": \"prod\",\"color\": \"9e9e9e\"},{\"id\": 3,\"url\": \"http://localhost:8000/api/extras/tags/3/\",\"display_url\": \"http://localhost:8000/extras/tags/3/\",\"display\": \"web\",\"name\": \"web\",\"slug\": \"web\",\"color\": \"9e9e9e\"}],\"custom_fields\": {\"test\": \"{'test': '5'}\"},\"created\": \"2025-08-11T14:37:28.180540Z\",\"last_updated\": \"2025-08-11T18:12:23.512163Z\",\"console_port_count\": 0,\"console_server_port_count\": 0,\"power_port_count\": 1,\"power_outlet_count\": 0,\"interface_count\": 1,\"front_port_count\": 0,\"rear_port_count\": 0,\"device_bay_count\": 0,\"module_bay_count\": 0,\"inventory_item_count\": 0}"
+ },
+ "netbox": {
+ "created": "2025-08-11T14:37:28.180Z",
+ "custom_fields": {
+ "test": "{'test': '5'}"
+ },
+ "device": {
+ "airflow": {
+ "label": "Front to rear",
+ "value": "front-to-rear"
+ },
+ "asset_tag": "macbook-server",
+ "cluster": {
+ "description": "test-description",
+ "display": "test",
+ "id": 1,
+ "name": "test",
+ "url": "http://localhost:8000/api/virtualization/clusters/1/"
+ },
+ "config_context": {
+ "hello": "world"
+ },
+ "config_template": {
+ "description": "asdf",
+ "display": "test",
+ "id": 1,
+ "name": "test",
+ "url": "http://localhost:8000/api/extras/config-templates/1/"
+ },
+ "console_port_count": 0,
+ "console_server_port_count": 0,
+ "coordinates": [
+ 5.0E-6,
+ 4.0E-6
+ ],
+ "description": "test server",
+ "device_bay_count": 0,
+ "device_type": {
+ "description": "Macbook Pro",
+ "display": "macbook pro",
+ "id": 1,
+ "manufacturer": {
+ "display": "Apple",
+ "id": 1,
+ "name": "Apple",
+ "slug": "apple",
+ "url": "http://localhost:8000/api/dcim/manufacturers/1/"
+ },
+ "model": "macbook pro",
+ "slug": "macbook-pro",
+ "url": "http://localhost:8000/api/dcim/device-types/1/"
+ },
+ "face": {
+ "label": "Front",
+ "value": "front"
+ },
+ "front_port_count": 0,
+ "id": 2,
+ "interface_count": 1,
+ "inventory_item_count": 0,
+ "local_context_data": {
+ "hello": "world"
+ },
+ "location": {
+ "_depth": 0,
+ "description": "some location",
+ "display": "location1",
+ "id": 1,
+ "name": "location1",
+ "rack_count": 0,
+ "slug": "location1",
+ "url": "http://localhost:8000/api/dcim/locations/1/"
+ },
+ "module_bay_count": 0,
+ "name": "server-1",
+ "oob_ip": {
+ "address": "192.168.1.100",
+ "description": "great desc",
+ "display": "192.168.1.100/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "platform": {
+ "description": "6trgyuhb",
+ "display": "some-playtofmr",
+ "id": 1,
+ "name": "some-playtofmr",
+ "slug": "some-playtofmr",
+ "url": "http://localhost:8000/api/dcim/platforms/1/"
+ },
+ "position": 1.0,
+ "power_outlet_count": 0,
+ "power_port_count": 1,
+ "primary_ip": {
+ "address": "192.168.1.100",
+ "description": "great desc",
+ "display": "192.168.1.100/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "primary_ip4": {
+ "address": "192.168.1.100",
+ "description": "great desc",
+ "display": "192.168.1.100/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "rack": {
+ "description": "test rack 1",
+ "display": "rack-1 (faciclity-id-123)",
+ "id": 1,
+ "name": "rack-1",
+ "url": "http://localhost:8000/api/dcim/racks/1/"
+ },
+ "rear_port_count": 0,
+ "role": {
+ "_depth": 0,
+ "display": "test-role",
+ "id": 1,
+ "name": "test-role",
+ "slug": "test-role",
+ "url": "http://localhost:8000/api/dcim/device-roles/1/"
+ },
+ "serial": "243rtgtbsasdf",
+ "site": {
+ "display": "test-site",
+ "id": 1,
+ "name": "test-site",
+ "slug": "test-site",
+ "url": "http://localhost:8000/api/dcim/sites/1/"
+ },
+ "status": {
+ "label": "Active",
+ "value": "active"
+ },
+ "vc_position": 1,
+ "virtual_chassis": {
+ "display": "asdf",
+ "id": 1,
+ "master": {
+ "display": "server-1 (macbook-server)",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "id": 2,
+ "name": "server-1",
+ "url": "http://localhost:8000/api/dcim/devices/2/"
+ },
+ "member_count": 2,
+ "name": "asdf",
+ "url": "http://localhost:8000/api/dcim/virtual-chassis/1/"
+ }
+ },
+ "display": "server-1 (macbook-server)",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "last_updated": "2025-08-11T18:12:23.512Z",
+ "tags": [
+ {
+ "color": "9e9e9e",
+ "display": "dev",
+ "display_url": "http://localhost:8000/extras/tags/2/",
+ "id": 2,
+ "name": "dev",
+ "slug": "dev",
+ "url": "http://localhost:8000/api/extras/tags/2/"
+ },
+ {
+ "color": "ff9800",
+ "display": "elastic",
+ "display_url": "http://localhost:8000/extras/tags/4/",
+ "id": 4,
+ "name": "elastic",
+ "slug": "elastic",
+ "url": "http://localhost:8000/api/extras/tags/4/"
+ },
+ {
+ "color": "9e9e9e",
+ "display": "prod",
+ "display_url": "http://localhost:8000/extras/tags/1/",
+ "id": 1,
+ "name": "prod",
+ "slug": "prod",
+ "url": "http://localhost:8000/api/extras/tags/1/"
+ },
+ {
+ "color": "9e9e9e",
+ "display": "web",
+ "display_url": "http://localhost:8000/extras/tags/3/",
+ "id": 3,
+ "name": "web",
+ "slug": "web",
+ "url": "http://localhost:8000/api/extras/tags/3/"
+ }
+ ],
+ "tenant": {
+ "description": "first tenant",
+ "display": "tenant-1",
+ "id": 1,
+ "name": "tenant-1",
+ "slug": "tenant-1",
+ "url": "http://localhost:8000/api/tenancy/tenants/1/"
+ },
+ "url": "http://localhost:8000/api/dcim/devices/2/"
+ },
+ "related": {
+ "ip": [
+ "192.168.1.100"
+ ]
+ },
+ "tags": [
+ "preserve_original_event"
+ ]
+ },
+ {
+ "@timestamp": "2022-10-24T21:16:62.827288935Z",
+ "ecs": {
+ "version": "8.11.0"
+ },
+ "event": {
+ "category": [
+ "configuration"
+ ],
+ "kind": "asset",
+ "original": "{\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/devices/1/\",\"display_url\": \"http://localhost:8000/dcim/devices/1/\",\"display\": \"user-1-macbook-pro (tag-1234)\",\"name\": \"user-1-macbook-pro\",\"device_type\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/device-types/1/\",\"display\": \"macbook pro\",\"manufacturer\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/manufacturers/1/\",\"display\": \"Apple\",\"name\": \"Apple\",\"slug\": \"apple\",\"description\": \"\"},\"model\": \"macbook pro\",\"slug\": \"macbook-pro\",\"description\": \"Macbook Pro\"},\"role\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/device-roles/1/\",\"display\": \"test-role\",\"name\": \"test-role\",\"slug\": \"test-role\",\"description\": \"\",\"_depth\": 0},\"tenant\": {\"id\": 1,\"url\": \"http://localhost:8000/api/tenancy/tenants/1/\",\"display\": \"tenant-1\",\"name\": \"tenant-1\",\"slug\": \"tenant-1\",\"description\": \"first tenant\"},\"platform\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/platforms/1/\",\"display\": \"some-playtofmr\",\"name\": \"some-playtofmr\",\"slug\": \"some-playtofmr\",\"description\": \"6trgyuhb\"},\"serial\": \"123345as3th23tr\",\"asset_tag\": \"tag-1234\",\"site\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/sites/1/\",\"display\": \"test-site\",\"name\": \"test-site\",\"slug\": \"test-site\",\"description\": \"\"},\"location\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/locations/1/\",\"display\": \"location1\",\"name\": \"location1\",\"slug\": \"location1\",\"description\": \"some location\",\"rack_count\": 0,\"_depth\": 0},\"rack\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/racks/1/\",\"display\": \"rack-1 (faciclity-id-123)\",\"name\": \"rack-1\",\"description\": \"test rack 1\"},\"position\": 2.0,\"face\": {\"value\": \"front\",\"label\": \"Front\"},\"latitude\": 1e-06,\"longitude\": 7e-06,\"parent_device\": null,\"status\": {\"value\": \"active\",\"label\": \"Active\"},\"airflow\": {\"value\": \"front-to-rear\",\"label\": \"Front to rear\"},\"primary_ip\": {\"id\": 2,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/2/\",\"display\": \"81.2.64.142/31\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"432rg\"},\"primary_ip4\": {\"id\": 2,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/2/\",\"display\": \"192.168.1.100/24\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"432rg\"},\"primary_ip6\": null,\"oob_ip\": {\"id\": 2,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/2/\",\"display\": \"192.168.1.100/24\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/24\",\"description\": \"432rg\"},\"cluster\": {\"id\": 1,\"url\": \"http://localhost:8000/api/virtualization/clusters/1/\",\"display\": \"test\",\"name\": \"test\",\"description\": \"test-description\"},\"virtual_chassis\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/virtual-chassis/1/\",\"display\": \"asdf\",\"name\": \"asdf\",\"master\": {\"id\": 2,\"url\": \"http://localhost:8000/api/dcim/devices/2/\",\"display_url\": \"http://localhost:8000/dcim/devices/2/\",\"display\": \"server-1 (macbook-server)\",\"name\": \"server-1\"},\"description\": \"\",\"member_count\": 2},\"vc_position\": 2,\"vc_priority\": 1,\"description\": \"test-description\",\"comments\": \"first comment\",\"config_template\": null,\"config_context\": {},\"local_context_data\": null,\"tags\": [{\"id\": 2,\"url\": \"http://localhost:8000/api/extras/tags/2/\",\"display_url\": \"http://localhost:8000/extras/tags/2/\",\"display\": \"dev\",\"name\": \"dev\",\"slug\": \"dev\",\"color\": \"9e9e9e\"}],\"custom_fields\": {\"test\": \"{'test': '5'}\"},\"created\": \"2025-08-11T14:26:04.132249Z\",\"last_updated\": \"2025-08-11T18:07:04.911893Z\",\"console_port_count\": 0,\"console_server_port_count\": 0,\"power_port_count\": 0,\"power_outlet_count\": 0,\"interface_count\": 1,\"front_port_count\": 0,\"rear_port_count\": 0,\"device_bay_count\": 0,\"module_bay_count\": 0,\"inventory_item_count\": 0}"
+ },
+ "netbox": {
+ "comments": "first comment",
+ "created": "2025-08-11T14:26:04.132Z",
+ "custom_fields": {
+ "test": "{'test': '5'}"
+ },
+ "device": {
+ "airflow": {
+ "label": "Front to rear",
+ "value": "front-to-rear"
+ },
+ "asset_tag": "tag-1234",
+ "cluster": {
+ "description": "test-description",
+ "display": "test",
+ "id": 1,
+ "name": "test",
+ "url": "http://localhost:8000/api/virtualization/clusters/1/"
+ },
+ "console_port_count": 0,
+ "console_server_port_count": 0,
+ "coordinates": [
+ 7.0E-6,
+ 1.0E-6
+ ],
+ "description": "test-description",
+ "device_bay_count": 0,
+ "device_type": {
+ "description": "Macbook Pro",
+ "display": "macbook pro",
+ "id": 1,
+ "manufacturer": {
+ "display": "Apple",
+ "id": 1,
+ "name": "Apple",
+ "slug": "apple",
+ "url": "http://localhost:8000/api/dcim/manufacturers/1/"
+ },
+ "model": "macbook pro",
+ "slug": "macbook-pro",
+ "url": "http://localhost:8000/api/dcim/device-types/1/"
+ },
+ "face": {
+ "label": "Front",
+ "value": "front"
+ },
+ "front_port_count": 0,
+ "id": 1,
+ "interface_count": 1,
+ "inventory_item_count": 0,
+ "location": {
+ "_depth": 0,
+ "description": "some location",
+ "display": "location1",
+ "id": 1,
+ "name": "location1",
+ "rack_count": 0,
+ "slug": "location1",
+ "url": "http://localhost:8000/api/dcim/locations/1/"
+ },
+ "module_bay_count": 0,
+ "name": "user-1-macbook-pro",
+ "oob_ip": {
+ "address": "192.168.1.100",
+ "description": "432rg",
+ "display": "192.168.1.100/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 2,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/2/"
+ },
+ "platform": {
+ "description": "6trgyuhb",
+ "display": "some-playtofmr",
+ "id": 1,
+ "name": "some-playtofmr",
+ "slug": "some-playtofmr",
+ "url": "http://localhost:8000/api/dcim/platforms/1/"
+ },
+ "position": 2.0,
+ "power_outlet_count": 0,
+ "power_port_count": 0,
+ "primary_ip": {
+ "address": "192.168.1.100",
+ "description": "432rg",
+ "display": "81.2.64.142/31",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 2,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/2/"
+ },
+ "primary_ip4": {
+ "address": "192.168.1.100",
+ "description": "432rg",
+ "display": "192.168.1.100/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 2,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/2/"
+ },
+ "rack": {
+ "description": "test rack 1",
+ "display": "rack-1 (faciclity-id-123)",
+ "id": 1,
+ "name": "rack-1",
+ "url": "http://localhost:8000/api/dcim/racks/1/"
+ },
+ "rear_port_count": 0,
+ "role": {
+ "_depth": 0,
+ "display": "test-role",
+ "id": 1,
+ "name": "test-role",
+ "slug": "test-role",
+ "url": "http://localhost:8000/api/dcim/device-roles/1/"
+ },
+ "serial": "123345as3th23tr",
+ "site": {
+ "display": "test-site",
+ "id": 1,
+ "name": "test-site",
+ "slug": "test-site",
+ "url": "http://localhost:8000/api/dcim/sites/1/"
+ },
+ "status": {
+ "label": "Active",
+ "value": "active"
+ },
+ "vc_position": 2,
+ "vc_priority": 1,
+ "virtual_chassis": {
+ "display": "asdf",
+ "id": 1,
+ "master": {
+ "display": "server-1 (macbook-server)",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "id": 2,
+ "name": "server-1",
+ "url": "http://localhost:8000/api/dcim/devices/2/"
+ },
+ "member_count": 2,
+ "name": "asdf",
+ "url": "http://localhost:8000/api/dcim/virtual-chassis/1/"
+ }
+ },
+ "display": "user-1-macbook-pro (tag-1234)",
+ "display_url": "http://localhost:8000/dcim/devices/1/",
+ "last_updated": "2025-08-11T18:07:04.911Z",
+ "tags": [
+ {
+ "color": "9e9e9e",
+ "display": "dev",
+ "display_url": "http://localhost:8000/extras/tags/2/",
+ "id": 2,
+ "name": "dev",
+ "slug": "dev",
+ "url": "http://localhost:8000/api/extras/tags/2/"
+ }
+ ],
+ "tenant": {
+ "description": "first tenant",
+ "display": "tenant-1",
+ "id": 1,
+ "name": "tenant-1",
+ "slug": "tenant-1",
+ "url": "http://localhost:8000/api/tenancy/tenants/1/"
+ },
+ "url": "http://localhost:8000/api/dcim/devices/1/"
+ },
+ "related": {
+ "ip": [
+ "192.168.1.100"
+ ]
+ },
+ "tags": [
+ "preserve_original_event"
+ ]
+ }
+ ]
+}
diff --git a/packages/netbox/data_stream/devices/_dev/test/system/test-default-config.yml b/packages/netbox/data_stream/devices/_dev/test/system/test-default-config.yml
new file mode 100644
index 00000000000..28ab84e7a28
--- /dev/null
+++ b/packages/netbox/data_stream/devices/_dev/test/system/test-default-config.yml
@@ -0,0 +1,12 @@
+input: httpjson
+service: netbox_mock
+vars:
+ url: http://{{Hostname}}:{{Port}}
+ token: --token--
+ enable_request_tracer: true
+data_stream:
+ vars:
+ preserve_original_event: true
+ limit: 2
+assert:
+ hit_count: 3
diff --git a/packages/netbox/data_stream/devices/agent/stream/httpjson.yml.hbs b/packages/netbox/data_stream/devices/agent/stream/httpjson.yml.hbs
new file mode 100644
index 00000000000..604355011ef
--- /dev/null
+++ b/packages/netbox/data_stream/devices/agent/stream/httpjson.yml.hbs
@@ -0,0 +1,54 @@
+config_version: 2
+interval: {{interval}}
+{{#if enable_request_tracer}}
+request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson"
+request.tracer.maxbackups: 5
+{{/if}}
+request.url: {{url}}/api/dcim/devices
+request.method: GET
+{{#if proxy_url }}
+request.proxy_url: {{proxy_url}}
+{{/if}}
+{{#if ssl}}
+request.ssl: {{ssl}}
+{{/if}}
+{{#if http_client_timeout}}
+request.timeout: {{http_client_timeout}}
+{{/if}}
+request.transforms:
+ - set:
+ target: "header.Content-Type"
+ value: "application/json"
+ - set:
+ target: "header.User-Agent"
+ value: "NetBox-Elastic-Filebeat/0.1.0"
+ - set:
+ target: "header.Authorization"
+ value: 'Token {{token}}'
+ - set:
+ target: "url.params.limit"
+ value: '{{limit}}'
+response.decode_as: application/json
+response.split:
+ target: body.results
+ ignore_empty_value: true
+response.pagination:
+ - set:
+ target: url.value
+ value: '[[if index .last_response.body "next"]][[.last_response.body.next]][[end]]'
+ fail_on_template_error: true
+
+tags:
+{{#if preserve_original_event}}
+ - preserve_original_event
+{{/if}}
+{{#each tags as |tag|}}
+ - {{tag}}
+{{/each}}
+{{#contains "forwarded" tags}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+{{#if processors}}
+processors:
+{{processors}}
+{{/if}}
diff --git a/packages/netbox/data_stream/devices/elasticsearch/ingest_pipeline/default.yml b/packages/netbox/data_stream/devices/elasticsearch/ingest_pipeline/default.yml
new file mode 100644
index 00000000000..ffb6b39ddd4
--- /dev/null
+++ b/packages/netbox/data_stream/devices/elasticsearch/ingest_pipeline/default.yml
@@ -0,0 +1,153 @@
+---
+description: Pipeline for processing sample logs
+processors:
+ - set:
+ field: ecs.version
+ tag: set_ecs_version
+ value: 8.11.0
+ - rename:
+ field: message
+ target_field: event.original
+ ignore_missing: true
+ if: ctx.event?.original == null
+ - remove:
+ field: message
+ ignore_missing: true
+ tag: remove_message
+ if: ctx.event?.original != null
+ - json:
+ field: event.original
+ target_field: netbox.device
+ - gsub:
+ field: netbox.device.primary_ip.address
+ pattern: "/\\d+$"
+ replacement: ""
+ ignore_missing: true
+ - append:
+ field: related.ip
+ value: "{{{netbox.device.primary_ip.address}}}"
+ if: ctx.netbox?.device?.primary_ip?.address != null
+ allow_duplicates: false
+ - gsub:
+ field: netbox.device.primary_ip4.address
+ pattern: "/\\d+$"
+ replacement: ""
+ ignore_missing: true
+ - append:
+ field: related.ip
+ value: "{{{netbox.device.primary_ip4.address}}}"
+ if: ctx.netbox?.device?.primary_ip4?.address != null
+ allow_duplicates: false
+ - gsub:
+ field: netbox.device.primary_ip6.address
+ pattern: "/\\d+$"
+ replacement: ""
+ ignore_missing: true
+ - append:
+ field: related.ip
+ value: "{{{netbox.device.primary_ip6.address}}}"
+ if: ctx.netbox?.device?.primary_ip6?.address != null
+ allow_duplicates: false
+ - gsub:
+ field: netbox.device.oob_ip.address
+ pattern: "/\\d+$"
+ replacement: ""
+ ignore_missing: true
+ - append:
+ field: related.ip
+ value: "{{{netbox.device.oob_ip.address}}}"
+ if: ctx.netbox?.device?.oob_ip?.address != null
+ allow_duplicates: false
+ - script:
+ lang: painless
+ if: ctx.netbox?.device?.longitude != null && ctx.netbox?.device?.latitude != null
+ source: |
+ ctx.netbox.device.coordinates = [
+ ctx.netbox.device.longitude,
+ ctx.netbox.device.latitude
+ ]
+ - remove:
+ field: [netbox.device.latitude, netbox.device.longitude]
+ ignore_missing: true
+ - rename:
+ field: netbox.device.url
+ target_field: netbox.url
+ ignore_missing: true
+ - rename:
+ field: netbox.device.display_url
+ target_field: netbox.display_url
+ ignore_missing: true
+ - rename:
+ field: netbox.device.display
+ target_field: netbox.display
+ ignore_missing: true
+ - rename:
+ field: netbox.device.comments
+ target_field: netbox.comments
+ ignore_missing: true
+ - rename:
+ field: netbox.device.created
+ target_field: netbox.created
+ ignore_missing: true
+ - rename:
+ field: netbox.device.last_updated
+ target_field: netbox.last_updated
+ ignore_missing: true
+ - rename:
+ field: netbox.device.custom_fields
+ target_field: netbox.custom_fields
+ ignore_missing: true
+ - rename:
+ field: netbox.device.tags
+ target_field: netbox.tags
+ ignore_missing: true
+ - rename:
+ field: netbox.device.tenant
+ target_field: netbox.tenant
+ ignore_missing: true
+ - set:
+ field: event.kind
+ value: asset
+ - append:
+ field: event.category
+ value: [configuration]
+ - date:
+ field: netbox.created
+ target_field: netbox.created
+ if: ctx.netbox?.created != null
+ formats:
+ - ISO8601
+ - date:
+ field: netbox.last_updated
+ target_field: netbox.last_updated
+ if: ctx.netbox?.last_updated != null
+ formats:
+ - ISO8601
+ - script:
+ description: Drops null/empty values recursively.
+ lang: painless
+ source: |
+ boolean dropEmptyFields(Object object) {
+ if (object == null || object == "") {
+ return true;
+ } else if (object instanceof Map) {
+ ((Map) object).values().removeIf(value -> dropEmptyFields(value));
+ return (((Map) object).size() == 0);
+ } else if (object instanceof List) {
+ ((List) object).removeIf(value -> dropEmptyFields(value));
+ return (((List) object).length == 0);
+ }
+ return false;
+ }
+ dropEmptyFields(ctx);
+on_failure:
+ - set:
+ field: event.kind
+ value: pipeline_error
+ - append:
+ field: tags
+ value: preserve_original_event
+ allow_duplicates: false
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
diff --git a/packages/netbox/data_stream/devices/fields/base-fields.yml b/packages/netbox/data_stream/devices/fields/base-fields.yml
new file mode 100644
index 00000000000..69e6cd8e7a6
--- /dev/null
+++ b/packages/netbox/data_stream/devices/fields/base-fields.yml
@@ -0,0 +1,15 @@
+- name: data_stream.type
+ type: constant_keyword
+ description: Data stream type.
+- name: data_stream.dataset
+ type: constant_keyword
+ description: Data stream dataset.
+- name: data_stream.namespace
+ type: constant_keyword
+ description: Data stream namespace.
+- name: '@timestamp'
+ type: date
+ description: Event timestamp.
+- name: input.type
+ type: keyword
+ description: Input type
diff --git a/packages/netbox/data_stream/devices/fields/fields.yml b/packages/netbox/data_stream/devices/fields/fields.yml
new file mode 100644
index 00000000000..e2d540b4559
--- /dev/null
+++ b/packages/netbox/data_stream/devices/fields/fields.yml
@@ -0,0 +1,519 @@
+- name: netbox
+ type: group
+ fields:
+ - name: url
+ type: keyword
+ description: The API URL for the device.
+ - name: display_url
+ type: keyword
+ description: The web UI URL for the device.
+ - name: display
+ type: keyword
+ description: The display name of the device.
+ - name: comments
+ type: text
+ description: User-provided comments for the device.
+ - name: last_updated
+ type: date
+ description: The timestamp when the device was last updated.
+ - name: created
+ type: date
+ description: The timestamp when the device was created.
+ - name: custom_fields
+ type: object
+ object_type: keyword
+ object_type_mapping_type: "*"
+ description: Custom fields configured for the device.
+ - name: tags
+ type: nested
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the tag.
+ - name: url
+ type: keyword
+ description: The API URL for the tag.
+ - name: display_url
+ type: keyword
+ description: The display URL for the tag.
+ - name: display
+ type: keyword
+ description: The display name of the tag.
+ - name: name
+ type: keyword
+ description: The name of the tag.
+ - name: slug
+ type: keyword
+ description: The slug of the tag.
+ - name: color
+ type: keyword
+ description: The color code of the tag.
+ - name: tenant
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the tenant.
+ - name: url
+ type: keyword
+ description: The API URL for the tenant.
+ - name: display
+ type: keyword
+ description: The display name of the tenant.
+ - name: name
+ type: keyword
+ description: The name of the tenant.
+ - name: slug
+ type: keyword
+ description: The slug of the tenant.
+ - name: description
+ type: text
+ description: The description of the tenant.
+ - name: device
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique numeric identifier for the device.
+ - name: coordinates
+ type: float
+ description: GPS coordinates in decimal format (longitude, latitude).
+ - name: name
+ type: keyword
+ description: The name of the device.
+ - name: device_type
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the device type.
+ - name: url
+ type: keyword
+ description: The API URL for the device type.
+ - name: display
+ type: keyword
+ description: The display name of the device type.
+ - name: manufacturer
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the manufacturer.
+ - name: url
+ type: keyword
+ description: The API URL for the manufacturer.
+ - name: display
+ type: keyword
+ description: The display name of the manufacturer.
+ - name: name
+ type: keyword
+ description: The name of the manufacturer.
+ - name: slug
+ type: keyword
+ description: The slug of the manufacturer.
+ - name: description
+ type: text
+ description: The description of the manufacturer.
+ - name: model
+ type: keyword
+ description: The model of the device type.
+ - name: slug
+ type: keyword
+ description: The slug of the device type.
+ - name: description
+ type: text
+ description: The description of the device type.
+ - name: role
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the device role.
+ - name: url
+ type: keyword
+ description: The API URL for the device role.
+ - name: display
+ type: keyword
+ description: The display name of the device role.
+ - name: name
+ type: keyword
+ description: The name of the device role.
+ - name: slug
+ type: keyword
+ description: The slug of the device role.
+ - name: description
+ type: text
+ description: The description of the device role.
+ - name: _depth
+ type: long
+ description: The depth level of the device role.
+ - name: platform
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the platform.
+ - name: url
+ type: keyword
+ description: The API URL for the platform.
+ - name: display
+ type: keyword
+ description: The display name of the platform.
+ - name: name
+ type: keyword
+ description: The name of the platform.
+ - name: slug
+ type: keyword
+ description: The slug of the platform.
+ - name: description
+ type: text
+ description: The description of the platform.
+ - name: serial
+ type: keyword
+ description: The serial number of the device.
+ - name: asset_tag
+ type: keyword
+ description: The asset tag of the device.
+ - name: site
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the site.
+ - name: url
+ type: keyword
+ description: The API URL for the site.
+ - name: display
+ type: keyword
+ description: The display name of the site.
+ - name: name
+ type: keyword
+ description: The name of the site.
+ - name: slug
+ type: keyword
+ description: The slug of the site.
+ - name: description
+ type: text
+ description: The description of the site.
+ - name: location
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the location.
+ - name: url
+ type: keyword
+ description: The API URL for the location.
+ - name: display
+ type: keyword
+ description: The display name of the location.
+ - name: name
+ type: keyword
+ description: The name of the location.
+ - name: slug
+ type: keyword
+ description: The slug of the location.
+ - name: description
+ type: text
+ description: The description of the location.
+ - name: rack_count
+ type: long
+ description: The number of racks in the location.
+ - name: _depth
+ type: long
+ description: The depth level of the location.
+ - name: virtual_chassis
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the virtual chassis.
+ - name: url
+ type: keyword
+ description: The API URL for the virtual chassis.
+ - name: display
+ type: keyword
+ description: The display name of the virtual chassis.
+ - name: name
+ type: keyword
+ description: The name of the virtual chassis.
+ - name: description
+ type: text
+ description: The description of the virtual chassis.
+ - name: master
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the master device.
+ - name: url
+ type: keyword
+ description: The API URL for the master device.
+ - name: display
+ type: keyword
+ description: The display name of the master device.
+ - name: display_url
+ type: keyword
+ description: The web UI URL for the master device.
+ - name: name
+ type: keyword
+ description: The name of the master device.
+ - name: member_count
+ type: long
+ description: The number of members in the virtual chassis.
+ - name: rack
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the rack.
+ - name: url
+ type: keyword
+ description: The API URL for the rack.
+ - name: display
+ type: keyword
+ description: The display name of the rack.
+ - name: name
+ type: keyword
+ description: The name of the rack.
+ - name: description
+ type: text
+ description: The description of the rack.
+ - name: position
+ type: long
+ description: The position of the device in the rack.
+ - name: face
+ type: group
+ fields:
+ - name: value
+ type: keyword
+ description: The value of the device face.
+ - name: label
+ type: keyword
+ description: The label of the device face.
+ - name: parent_device
+ type: keyword
+ description: The parent device identifier.
+ - name: status
+ type: group
+ fields:
+ - name: value
+ type: keyword
+ description: The status value of the device.
+ - name: label
+ type: keyword
+ description: The status label of the device.
+ - name: airflow
+ type: group
+ fields:
+ - name: value
+ type: keyword
+ description: The airflow value of the device.
+ - name: label
+ type: keyword
+ description: The airflow label of the device.
+ - name: primary_ip
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the primary IP address.
+ - name: url
+ type: keyword
+ description: The API URL for the primary IP address.
+ - name: address
+ type: ip
+ description: The primary IP address.
+ - name: display
+ type: keyword
+ description: The display name of the primary IP address.
+ - name: name
+ type: keyword
+ description: The name of the primary IP address.
+ - name: description
+ type: text
+ description: The description of the primary IP address.
+ - name: family
+ type: group
+ fields:
+ - name: value
+ type: long
+ description: The IP family value (4 for IPv4, 6 for IPv6).
+ - name: label
+ type: keyword
+ description: The IP family label (IPv4 or IPv6).
+ - name: primary_ip4
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the primary IPv4 address.
+ - name: url
+ type: keyword
+ description: The API URL for the primary IPv4 address.
+ - name: address
+ type: ip
+ description: The primary IPv4 address.
+ - name: display
+ type: keyword
+ description: The display name of the primary IPv4 address.
+ - name: name
+ type: keyword
+ description: The name of the primary IPv4 address.
+ - name: description
+ type: text
+ description: The description of the primary IPv4 address.
+ - name: family
+ type: group
+ fields:
+ - name: value
+ type: long
+ description: The IP family value (4 for IPv4).
+ - name: label
+ type: keyword
+ description: The IP family label (IPv4).
+ - name: primary_ip6
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the primary IPv6 address.
+ - name: url
+ type: keyword
+ description: The API URL for the primary IPv6 address.
+ - name: address
+ type: ip
+ description: The primary IPv6 address.
+ - name: display
+ type: keyword
+ description: The display name of the primary IPv6 address.
+ - name: name
+ type: keyword
+ description: The name of the primary IPv6 address.
+ - name: description
+ type: text
+ description: The description of the primary IPv6 address.
+ - name: family
+ type: group
+ fields:
+ - name: value
+ type: long
+ description: The IP family value (6 for IPv6).
+ - name: label
+ type: keyword
+ description: The IP family label (IPv6).
+ - name: oob_ip
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the out-of-band IP address.
+ - name: url
+ type: keyword
+ description: The API URL for the out-of-band IP address.
+ - name: address
+ type: ip
+ description: The out-of-band IP address.
+ - name: display
+ type: keyword
+ description: The display name of the out-of-band IP address.
+ - name: name
+ type: keyword
+ description: The name of the out-of-band IP address.
+ - name: description
+ type: text
+ description: The description of the out-of-band IP address.
+ - name: family
+ type: group
+ fields:
+ - name: value
+ type: long
+ description: The IP family value (4 for IPv4, 6 for IPv6).
+ - name: label
+ type: keyword
+ description: The IP family label (IPv4 or IPv6).
+ - name: cluster
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the cluster.
+ - name: url
+ type: keyword
+ description: The API URL for the cluster.
+ - name: display
+ type: keyword
+ description: The display name of the cluster.
+ - name: name
+ type: keyword
+ description: The name of the cluster.
+ - name: description
+ type: text
+ description: The description of the cluster.
+ - name: vc_position
+ type: long
+ description: The virtual chassis position of the device.
+ - name: vc_priority
+ type: long
+ description: The virtual chassis priority of the device.
+ - name: description
+ type: text
+ description: The description of the device.
+ - name: config_template
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the config template.
+ - name: url
+ type: keyword
+ description: The API URL for the config template.
+ - name: description
+ type: text
+ description: The description of the config template.
+ - name: display
+ type: keyword
+ description: The display name of the config template.
+ - name: name
+ type: keyword
+ description: The name of the config template.
+ - name: config_context
+ type: object
+ object_type: keyword
+ object_type_mapping_type: "*"
+ description: The configuration context of the device.
+ - name: local_context_data
+ type: object
+ object_type: keyword
+ object_type_mapping_type: "*"
+ description: The local context data of the device.
+ - name: console_port_count
+ type: long
+ description: The number of console ports on the device.
+ - name: console_server_port_count
+ type: long
+ description: The number of console server ports on the device.
+ - name: power_port_count
+ type: long
+ description: The number of power ports on the device.
+ - name: power_outlet_count
+ type: long
+ description: The number of power outlets on the device.
+ - name: interface_count
+ type: long
+ description: The number of interfaces on the device.
+ - name: front_port_count
+ type: long
+ description: The number of front ports on the device.
+ - name: rear_port_count
+ type: long
+ description: The number of rear ports on the device.
+ - name: device_bay_count
+ type: long
+ description: The number of device bays on the device.
+ - name: module_bay_count
+ type: long
+ description: The number of module bays on the device.
+ - name: inventory_item_count
+ type: long
+ description: The number of inventory items associated with the device.
diff --git a/packages/netbox/data_stream/devices/manifest.yml b/packages/netbox/data_stream/devices/manifest.yml
new file mode 100644
index 00000000000..cb2eef16604
--- /dev/null
+++ b/packages/netbox/data_stream/devices/manifest.yml
@@ -0,0 +1,47 @@
+title: "Devices"
+type: logs
+streams:
+ - input: httpjson
+ title: "Collect NetBox devices"
+ description: "Collect devices from NetBox via the NetBox API"
+ enabled: true
+ template_path: httpjson.yml.hbs
+ vars:
+ - name: limit
+ type: integer
+ title: Limit
+ description: Number of events to fetch on each request
+ show_user: false
+ required: true
+ default: 50
+ - name: interval
+ type: text
+ title: Interval to query NetBox API
+ description: Go Duration syntax (eg. 10s)
+ show_user: false
+ required: true
+ default: 1h
+ - name: tags
+ type: text
+ title: Tags
+ multi: true
+ show_user: false
+ default:
+ - forwarded
+ - netbox-devices
+ - name: preserve_original_event
+ required: true
+ show_user: true
+ title: Preserve original event
+ description: Preserves a raw copy of the original event, added to the field `event.original`
+ type: bool
+ multi: false
+ default: false
+ - name: processors
+ type: yaml
+ title: Processors
+ multi: false
+ required: false
+ show_user: false
+ description: >-
+ Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
diff --git a/packages/netbox/data_stream/devices/sample_event.json b/packages/netbox/data_stream/devices/sample_event.json
new file mode 100644
index 00000000000..1cf07d34d98
--- /dev/null
+++ b/packages/netbox/data_stream/devices/sample_event.json
@@ -0,0 +1,319 @@
+{
+ "@timestamp": "2025-11-19T16:29:30.984Z",
+ "agent": {
+ "ephemeral_id": "26808a50-5696-4206-86b9-3f8f56d7dd48",
+ "id": "c17ce5b2-739e-4040-a21c-79a45b4570fe",
+ "name": "elastic-agent-89017",
+ "type": "filebeat",
+ "version": "9.2.1"
+ },
+ "data_stream": {
+ "dataset": "netbox.devices",
+ "namespace": "89710",
+ "type": "logs"
+ },
+ "ecs": {
+ "version": "8.11.0"
+ },
+ "elastic_agent": {
+ "id": "c17ce5b2-739e-4040-a21c-79a45b4570fe",
+ "snapshot": false,
+ "version": "9.2.1"
+ },
+ "event": {
+ "agent_id_status": "verified",
+ "category": [
+ "configuration"
+ ],
+ "created": "2025-11-19T16:29:30.984Z",
+ "dataset": "netbox.devices",
+ "ingested": "2025-11-19T16:29:33Z",
+ "kind": "asset",
+ "original": "{\"airflow\":{\"label\":\"Front to rear\",\"value\":\"front-to-rear\"},\"asset_tag\":\"WEB-001\",\"cluster\":{\"description\":\"Production web application cluster\",\"display\":\"web-cluster\",\"id\":1,\"name\":\"web-cluster\",\"url\":\"http://localhost:8000/api/virtualization/clusters/1/\"},\"comments\":\"\",\"config_context\":{\"backup_enabled\":true,\"environment\":\"production\"},\"config_template\":{\"description\":\"Standard Ubuntu web server configuration template\",\"display\":\"ubuntu-web-template\",\"id\":1,\"name\":\"ubuntu-web-template\",\"url\":\"http://localhost:8000/api/extras/config-templates/1/\"},\"console_port_count\":0,\"console_server_port_count\":0,\"created\":\"2025-08-11T14:37:28.180540Z\",\"custom_fields\":{\"maintenance_window\":\"Sunday 02:00-04:00 EST\"},\"description\":\"Primary web server for customer portal\",\"device_bay_count\":0,\"device_type\":{\"description\":\"Dell PowerEdge R740 2U Rack Server\",\"display\":\"dell poweredge r740\",\"id\":1,\"manufacturer\":{\"description\":\"\",\"display\":\"Dell\",\"id\":1,\"name\":\"Dell\",\"slug\":\"dell\",\"url\":\"http://localhost:8000/api/dcim/manufacturers/1/\"},\"model\":\"poweredge r740\",\"slug\":\"poweredge-r740\",\"url\":\"http://localhost:8000/api/dcim/device-types/1/\"},\"display\":\"web-srv-01 (WEB-001)\",\"display_url\":\"http://localhost:8000/dcim/devices/2/\",\"face\":{\"label\":\"Front\",\"value\":\"front\"},\"front_port_count\":0,\"id\":2,\"interface_count\":4,\"inventory_item_count\":0,\"last_updated\":\"2025-08-11T18:12:23.512163Z\",\"latitude\":39.0458,\"local_context_data\":{\"monitoring\":\"enabled\",\"ssl_cert\":\"wildcard.acme.com\"},\"location\":{\"_depth\":0,\"description\":\"Primary server room - Zone A\",\"display\":\"server-room-a\",\"id\":1,\"name\":\"server-room-a\",\"rack_count\":0,\"slug\":\"server-room-a\",\"url\":\"http://localhost:8000/api/dcim/locations/1/\"},\"longitude\":-76.6413,\"module_bay_count\":0,\"name\":\"web-srv-01\",\"oob_ip\":{\"address\":\"10.0.100.15/24\",\"description\":\"Out-of-band management interface\",\"display\":\"10.0.100.15/24\",\"family\":{\"label\":\"IPv4\",\"value\":4},\"id\":1,\"url\":\"http://localhost:8000/api/ipam/ip-addresses/1/\"},\"parent_device\":null,\"platform\":{\"description\":\"Ubuntu Server 22.04 LTS\",\"display\":\"ubuntu-server\",\"id\":1,\"name\":\"ubuntu-server\",\"slug\":\"ubuntu-server\",\"url\":\"http://localhost:8000/api/dcim/platforms/1/\"},\"position\":15,\"power_outlet_count\":0,\"power_port_count\":2,\"primary_ip\":{\"address\":\"10.0.1.15/24\",\"description\":\"Primary web server interface\",\"display\":\"10.0.1.15/24\",\"family\":{\"label\":\"IPv4\",\"value\":4},\"id\":1,\"url\":\"http://localhost:8000/api/ipam/ip-addresses/1/\"},\"primary_ip4\":{\"address\":\"10.0.1.15/24\",\"description\":\"Primary web server interface\",\"display\":\"10.0.1.15/24\",\"family\":{\"label\":\"IPv4\",\"value\":4},\"id\":1,\"url\":\"http://localhost:8000/api/ipam/ip-addresses/1/\"},\"primary_ip6\":null,\"rack\":{\"description\":\"42U server rack - Zone A, Row 1\",\"display\":\"rack-a01 (DC-EAST-A01)\",\"id\":1,\"name\":\"rack-a01\",\"url\":\"http://localhost:8000/api/dcim/racks/1/\"},\"rear_port_count\":0,\"role\":{\"_depth\":0,\"description\":\"\",\"display\":\"web-server\",\"id\":1,\"name\":\"web-server\",\"slug\":\"web-server\",\"url\":\"http://localhost:8000/api/dcim/device-roles/1/\"},\"serial\":\"CN7016A2B90001\",\"site\":{\"description\":\"\",\"display\":\"datacenter-east\",\"id\":1,\"name\":\"datacenter-east\",\"slug\":\"datacenter-east\",\"url\":\"http://localhost:8000/api/dcim/sites/1/\"},\"status\":{\"label\":\"Active\",\"value\":\"active\"},\"tags\":[{\"color\":\"4caf50\",\"display\":\"production\",\"display_url\":\"http://localhost:8000/extras/tags/2/\",\"id\":2,\"name\":\"production\",\"slug\":\"production\",\"url\":\"http://localhost:8000/api/extras/tags/2/\"},{\"color\":\"2196f3\",\"display\":\"web-tier\",\"display_url\":\"http://localhost:8000/extras/tags/4/\",\"id\":4,\"name\":\"web-tier\",\"slug\":\"web-tier\",\"url\":\"http://localhost:8000/api/extras/tags/4/\"},{\"color\":\"f44336\",\"display\":\"critical\",\"display_url\":\"http://localhost:8000/extras/tags/1/\",\"id\":1,\"name\":\"critical\",\"slug\":\"critical\",\"url\":\"http://localhost:8000/api/extras/tags/1/\"},{\"color\":\"ff9800\",\"display\":\"monitored\",\"display_url\":\"http://localhost:8000/extras/tags/3/\",\"id\":3,\"name\":\"monitored\",\"slug\":\"monitored\",\"url\":\"http://localhost:8000/api/extras/tags/3/\"}],\"tenant\":{\"description\":\"Acme Corporation primary tenant\",\"display\":\"acme-corp\",\"id\":1,\"name\":\"acme-corp\",\"slug\":\"acme-corp\",\"url\":\"http://localhost:8000/api/tenancy/tenants/1/\"},\"url\":\"http://localhost:8000/api/dcim/devices/2/\",\"vc_position\":1,\"vc_priority\":null,\"virtual_chassis\":{\"description\":\"\",\"display\":\"web-cluster-vc\",\"id\":1,\"master\":{\"display\":\"web-srv-01 (WEB-001)\",\"display_url\":\"http://localhost:8000/dcim/devices/2/\",\"id\":2,\"name\":\"web-srv-01\",\"url\":\"http://localhost:8000/api/dcim/devices/2/\"},\"member_count\":2,\"name\":\"web-cluster-vc\",\"url\":\"http://localhost:8000/api/dcim/virtual-chassis/1/\"}}"
+ },
+ "input": {
+ "type": "httpjson"
+ },
+ "netbox": {
+ "created": "2025-08-11T14:37:28.180Z",
+ "custom_fields": {
+ "maintenance_window": "Sunday 02:00-04:00 EST"
+ },
+ "device": {
+ "airflow": {
+ "label": "Front to rear",
+ "value": "front-to-rear"
+ },
+ "asset_tag": "WEB-001",
+ "cluster": {
+ "description": "Production web application cluster",
+ "display": "web-cluster",
+ "id": 1,
+ "name": "web-cluster",
+ "url": "http://localhost:8000/api/virtualization/clusters/1/"
+ },
+ "config_context": {
+ "backup_enabled": "true",
+ "environment": "production"
+ },
+ "config_template": {
+ "description": "Standard Ubuntu web server configuration template",
+ "display": "ubuntu-web-template",
+ "id": 1,
+ "name": "ubuntu-web-template",
+ "url": "http://localhost:8000/api/extras/config-templates/1/"
+ },
+ "console_port_count": 0,
+ "console_server_port_count": 0,
+ "coordinates": [
+ -76.6413,
+ 39.0458
+ ],
+ "description": "Primary web server for customer portal",
+ "device_bay_count": 0,
+ "device_type": {
+ "description": "Dell PowerEdge R740 2U Rack Server",
+ "display": "dell poweredge r740",
+ "id": 1,
+ "manufacturer": {
+ "display": "Dell",
+ "id": 1,
+ "name": "Dell",
+ "slug": "dell",
+ "url": "http://localhost:8000/api/dcim/manufacturers/1/"
+ },
+ "model": "poweredge r740",
+ "slug": "poweredge-r740",
+ "url": "http://localhost:8000/api/dcim/device-types/1/"
+ },
+ "face": {
+ "label": "Front",
+ "value": "front"
+ },
+ "front_port_count": 0,
+ "id": 2,
+ "interface_count": 4,
+ "inventory_item_count": 0,
+ "local_context_data": {
+ "monitoring": "enabled",
+ "ssl_cert": "wildcard.acme.com"
+ },
+ "location": {
+ "_depth": 0,
+ "description": "Primary server room - Zone A",
+ "display": "server-room-a",
+ "id": 1,
+ "name": "server-room-a",
+ "rack_count": 0,
+ "slug": "server-room-a",
+ "url": "http://localhost:8000/api/dcim/locations/1/"
+ },
+ "module_bay_count": 0,
+ "name": "web-srv-01",
+ "oob_ip": {
+ "address": "10.0.100.15",
+ "description": "Out-of-band management interface",
+ "display": "10.0.100.15/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "platform": {
+ "description": "Ubuntu Server 22.04 LTS",
+ "display": "ubuntu-server",
+ "id": 1,
+ "name": "ubuntu-server",
+ "slug": "ubuntu-server",
+ "url": "http://localhost:8000/api/dcim/platforms/1/"
+ },
+ "position": 15,
+ "power_outlet_count": 0,
+ "power_port_count": 2,
+ "primary_ip": {
+ "address": "10.0.1.15",
+ "description": "Primary web server interface",
+ "display": "10.0.1.15/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "primary_ip4": {
+ "address": "10.0.1.15",
+ "description": "Primary web server interface",
+ "display": "10.0.1.15/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "rack": {
+ "description": "42U server rack - Zone A, Row 1",
+ "display": "rack-a01 (DC-EAST-A01)",
+ "id": 1,
+ "name": "rack-a01",
+ "url": "http://localhost:8000/api/dcim/racks/1/"
+ },
+ "rear_port_count": 0,
+ "role": {
+ "_depth": 0,
+ "display": "web-server",
+ "id": 1,
+ "name": "web-server",
+ "slug": "web-server",
+ "url": "http://localhost:8000/api/dcim/device-roles/1/"
+ },
+ "serial": "CN7016A2B90001",
+ "site": {
+ "display": "datacenter-east",
+ "id": 1,
+ "name": "datacenter-east",
+ "slug": "datacenter-east",
+ "url": "http://localhost:8000/api/dcim/sites/1/"
+ },
+ "status": {
+ "label": "Active",
+ "value": "active"
+ },
+ "vc_position": 1,
+ "virtual_chassis": {
+ "display": "web-cluster-vc",
+ "id": 1,
+ "master": {
+ "display": "web-srv-01 (WEB-001)",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "id": 2,
+ "name": "web-srv-01",
+ "url": "http://localhost:8000/api/dcim/devices/2/"
+ },
+ "member_count": 2,
+ "name": "web-cluster-vc",
+ "url": "http://localhost:8000/api/dcim/virtual-chassis/1/"
+ }
+ },
+ "display": "web-srv-01 (WEB-001)",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "last_updated": "2025-08-11T18:12:23.512Z",
+ "tags": [
+ {
+ "color": [
+ "4caf50"
+ ],
+ "display": [
+ "production"
+ ],
+ "display_url": [
+ "http://localhost:8000/extras/tags/2/"
+ ],
+ "id": [
+ 2
+ ],
+ "name": [
+ "production"
+ ],
+ "slug": [
+ "production"
+ ],
+ "url": [
+ "http://localhost:8000/api/extras/tags/2/"
+ ]
+ },
+ {
+ "color": [
+ "2196f3"
+ ],
+ "display": [
+ "web-tier"
+ ],
+ "display_url": [
+ "http://localhost:8000/extras/tags/4/"
+ ],
+ "id": [
+ 4
+ ],
+ "name": [
+ "web-tier"
+ ],
+ "slug": [
+ "web-tier"
+ ],
+ "url": [
+ "http://localhost:8000/api/extras/tags/4/"
+ ]
+ },
+ {
+ "color": [
+ "f44336"
+ ],
+ "display": [
+ "critical"
+ ],
+ "display_url": [
+ "http://localhost:8000/extras/tags/1/"
+ ],
+ "id": [
+ 1
+ ],
+ "name": [
+ "critical"
+ ],
+ "slug": [
+ "critical"
+ ],
+ "url": [
+ "http://localhost:8000/api/extras/tags/1/"
+ ]
+ },
+ {
+ "color": [
+ "ff9800"
+ ],
+ "display": [
+ "monitored"
+ ],
+ "display_url": [
+ "http://localhost:8000/extras/tags/3/"
+ ],
+ "id": [
+ 3
+ ],
+ "name": [
+ "monitored"
+ ],
+ "slug": [
+ "monitored"
+ ],
+ "url": [
+ "http://localhost:8000/api/extras/tags/3/"
+ ]
+ }
+ ],
+ "tenant": {
+ "description": "Acme Corporation primary tenant",
+ "display": "acme-corp",
+ "id": 1,
+ "name": "acme-corp",
+ "slug": "acme-corp",
+ "url": "http://localhost:8000/api/tenancy/tenants/1/"
+ },
+ "url": "http://localhost:8000/api/dcim/devices/2/"
+ },
+ "related": {
+ "ip": [
+ "10.0.1.15",
+ "10.0.100.15"
+ ]
+ },
+ "tags": [
+ "preserve_original_event",
+ "forwarded",
+ "netbox-devices"
+ ]
+}
diff --git a/packages/netbox/data_stream/ips/_dev/test/pipeline/test-devices.json b/packages/netbox/data_stream/ips/_dev/test/pipeline/test-devices.json
new file mode 100644
index 00000000000..9c367551e4a
--- /dev/null
+++ b/packages/netbox/data_stream/ips/_dev/test/pipeline/test-devices.json
@@ -0,0 +1,12 @@
+{
+ "events": [
+ {
+ "@timestamp": "2022-10-24T21:16:62.827288935Z",
+ "message": "{\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display_url\": \"http://localhost:8000/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/32\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/32\",\"vrf\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/vrfs/1/\",\"display\": \"test\",\"name\": \"test\",\"rd\": null,\"description\": \"asdf\"},\"tenant\": {\"id\": 1,\"url\": \"http://localhost:8000/api/tenancy/tenants/1/\",\"display\": \"tenant-1\",\"name\": \"tenant-1\",\"slug\": \"tenant-1\",\"description\": \"first tenant\"},\"status\": {\"value\": \"active\",\"label\": \"Active\"},\"role\": {\"value\": \"secondary\",\"label\": \"Secondary\"},\"assigned_object_type\": \"dcim.interface\",\"assigned_object_id\": 1,\"assigned_object\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/interfaces/1/\",\"display\": \"test1\",\"device\": {\"id\": 2,\"url\": \"http://localhost:8000/api/dcim/devices/2/\",\"display\": \"server-1 (macbook-server)\",\"name\": \"server-1\",\"description\": \"test server\"},\"name\": \"test1\",\"description\": \"wlan\",\"cable\": null,\"_occupied\": false},\"nat_inside\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display_url\": \"http://localhost:8000/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/32\",\"family\": 4,\"address\": \"192.168.1.100/32\"},\"nat_outside\": [{\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display_url\": \"http://localhost:8000/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/32\",\"family\": 4,\"address\": \"192.168.1.100/32\"}],\"dns_name\": \"test.co\",\"description\": \"great desc\",\"comments\": \"\",\"tags\": [{\"id\": 2,\"url\": \"http://localhost:8000/api/extras/tags/2/\",\"display_url\": \"http://localhost:8000/extras/tags/2/\",\"display\": \"dev\",\"name\": \"dev\",\"slug\": \"dev\",\"color\": \"9e9e9e\"},{\"id\": 3,\"url\": \"http://localhost:8000/api/extras/tags/3/\",\"display_url\": \"http://localhost:8000/extras/tags/3/\",\"display\": \"web\",\"name\": \"web\",\"slug\": \"web\",\"color\": \"9e9e9e\"}],\"custom_fields\": {},\"created\": \"2025-08-11T16:49:52.511883Z\",\"last_updated\": \"2025-08-12T12:50:29.063329Z\"}"
+ },
+ {
+ "@timestamp": "2022-10-24T21:16:62.827288935Z",
+ "message": "{\"id\": 2,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/2/\",\"display_url\": \"http://localhost:8000/ipam/ip-addresses/2/\",\"display\": \"192.168.1.101/32\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.101/32\",\"vrf\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/vrfs/1/\",\"display\": \"test\",\"name\": \"test\",\"rd\": null,\"description\": \"asdf\"},\"tenant\": {\"id\": 1,\"url\": \"http://localhost:8000/api/tenancy/tenants/1/\",\"display\": \"tenant-1\",\"name\": \"tenant-1\",\"slug\": \"tenant-1\",\"description\": \"first tenant\"},\"status\": {\"value\": \"active\",\"label\": \"Active\"},\"role\": {\"value\": \"secondary\",\"label\": \"Secondary\"},\"assigned_object_type\": \"dcim.interface\",\"assigned_object_id\": 2,\"assigned_object\": {\"id\": 2,\"url\": \"http://localhost:8000/api/dcim/interfaces/2/\",\"display\": \"hello\",\"device\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/devices/1/\",\"display\": \"user-1-macbook-pro (tag-1234)\",\"name\": \"user-1-macbook-pro\",\"description\": \"test-description\"},\"name\": \"hello\",\"description\": \"test-description\",\"cable\": null,\"_occupied\": false},\"nat_inside\": null,\"nat_outside\": [],\"dns_name\": \"hello.world\",\"description\": \"432rg\",\"comments\": \"\",\"tags\": [{\"id\": 4,\"url\": \"http://localhost:8000/api/extras/tags/4/\",\"display_url\": \"http://localhost:8000/extras/tags/4/\",\"display\": \"elastic\",\"name\": \"elastic\",\"slug\": \"elastic\",\"color\": \"ff9800\"}],\"custom_fields\": {},\"created\": \"2025-08-11T18:07:04.795476Z\",\"last_updated\": \"2025-08-11T18:07:04.795486Z\"}"
+ }
+ ]
+}
diff --git a/packages/netbox/data_stream/ips/_dev/test/pipeline/test-devices.json-config.yml b/packages/netbox/data_stream/ips/_dev/test/pipeline/test-devices.json-config.yml
new file mode 100644
index 00000000000..c58118a2420
--- /dev/null
+++ b/packages/netbox/data_stream/ips/_dev/test/pipeline/test-devices.json-config.yml
@@ -0,0 +1,4 @@
+fields:
+ "@timestamp": "2022-10-24T21:16:62.827288935Z"
+ tags:
+ - preserve_original_event
diff --git a/packages/netbox/data_stream/ips/_dev/test/pipeline/test-devices.json-expected.json b/packages/netbox/data_stream/ips/_dev/test/pipeline/test-devices.json-expected.json
new file mode 100644
index 00000000000..c5d80d1b06f
--- /dev/null
+++ b/packages/netbox/data_stream/ips/_dev/test/pipeline/test-devices.json-expected.json
@@ -0,0 +1,209 @@
+{
+ "expected": [
+ {
+ "@timestamp": "2022-10-24T21:16:62.827288935Z",
+ "ecs": {
+ "version": "8.11.0"
+ },
+ "event": {
+ "category": [
+ "configuration"
+ ],
+ "kind": "asset",
+ "original": "{\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display_url\": \"http://localhost:8000/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/32\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.100/32\",\"vrf\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/vrfs/1/\",\"display\": \"test\",\"name\": \"test\",\"rd\": null,\"description\": \"asdf\"},\"tenant\": {\"id\": 1,\"url\": \"http://localhost:8000/api/tenancy/tenants/1/\",\"display\": \"tenant-1\",\"name\": \"tenant-1\",\"slug\": \"tenant-1\",\"description\": \"first tenant\"},\"status\": {\"value\": \"active\",\"label\": \"Active\"},\"role\": {\"value\": \"secondary\",\"label\": \"Secondary\"},\"assigned_object_type\": \"dcim.interface\",\"assigned_object_id\": 1,\"assigned_object\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/interfaces/1/\",\"display\": \"test1\",\"device\": {\"id\": 2,\"url\": \"http://localhost:8000/api/dcim/devices/2/\",\"display\": \"server-1 (macbook-server)\",\"name\": \"server-1\",\"description\": \"test server\"},\"name\": \"test1\",\"description\": \"wlan\",\"cable\": null,\"_occupied\": false},\"nat_inside\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display_url\": \"http://localhost:8000/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/32\",\"family\": 4,\"address\": \"192.168.1.100/32\"},\"nat_outside\": [{\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/1/\",\"display_url\": \"http://localhost:8000/ipam/ip-addresses/1/\",\"display\": \"192.168.1.100/32\",\"family\": 4,\"address\": \"192.168.1.100/32\"}],\"dns_name\": \"test.co\",\"description\": \"great desc\",\"comments\": \"\",\"tags\": [{\"id\": 2,\"url\": \"http://localhost:8000/api/extras/tags/2/\",\"display_url\": \"http://localhost:8000/extras/tags/2/\",\"display\": \"dev\",\"name\": \"dev\",\"slug\": \"dev\",\"color\": \"9e9e9e\"},{\"id\": 3,\"url\": \"http://localhost:8000/api/extras/tags/3/\",\"display_url\": \"http://localhost:8000/extras/tags/3/\",\"display\": \"web\",\"name\": \"web\",\"slug\": \"web\",\"color\": \"9e9e9e\"}],\"custom_fields\": {},\"created\": \"2025-08-11T16:49:52.511883Z\",\"last_updated\": \"2025-08-12T12:50:29.063329Z\"}"
+ },
+ "netbox": {
+ "created": "2025-08-11T16:49:52.511Z",
+ "display": "192.168.1.100/32",
+ "display_url": "http://localhost:8000/ipam/ip-addresses/1/",
+ "ip": {
+ "address": "192.168.1.100",
+ "assigned_object": {
+ "_occupied": false,
+ "description": "wlan",
+ "device": {
+ "description": "test server",
+ "display": "server-1 (macbook-server)",
+ "id": 2,
+ "name": "server-1",
+ "url": "http://localhost:8000/api/dcim/devices/2/"
+ },
+ "display": "test1",
+ "id": 1,
+ "name": "test1",
+ "url": "http://localhost:8000/api/dcim/interfaces/1/"
+ },
+ "assigned_object_id": 1,
+ "assigned_object_type": "dcim.interface",
+ "description": "great desc",
+ "dns_name": "test.co",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 1,
+ "nat_inside": {
+ "address": "192.168.1.100",
+ "display": "192.168.1.100/32",
+ "display_url": "http://localhost:8000/ipam/ip-addresses/1/",
+ "family": 4,
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "nat_outside": [
+ {
+ "address": "192.168.1.100",
+ "display": "192.168.1.100/32",
+ "display_url": "http://localhost:8000/ipam/ip-addresses/1/",
+ "family": 4,
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ }
+ ],
+ "role": {
+ "label": "Secondary",
+ "value": "secondary"
+ },
+ "status": {
+ "label": "Active",
+ "value": "active"
+ },
+ "vrf": {
+ "description": "asdf",
+ "display": "test",
+ "id": 1,
+ "name": "test",
+ "url": "http://localhost:8000/api/ipam/vrfs/1/"
+ }
+ },
+ "last_updated": "2025-08-12T12:50:29.063Z",
+ "tags": [
+ {
+ "color": "9e9e9e",
+ "display": "dev",
+ "display_url": "http://localhost:8000/extras/tags/2/",
+ "id": 2,
+ "name": "dev",
+ "slug": "dev",
+ "url": "http://localhost:8000/api/extras/tags/2/"
+ },
+ {
+ "color": "9e9e9e",
+ "display": "web",
+ "display_url": "http://localhost:8000/extras/tags/3/",
+ "id": 3,
+ "name": "web",
+ "slug": "web",
+ "url": "http://localhost:8000/api/extras/tags/3/"
+ }
+ ],
+ "tenant": {
+ "description": "first tenant",
+ "display": "tenant-1",
+ "id": 1,
+ "name": "tenant-1",
+ "slug": "tenant-1",
+ "url": "http://localhost:8000/api/tenancy/tenants/1/"
+ },
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "related": {
+ "ip": [
+ "192.168.1.100"
+ ]
+ },
+ "tags": [
+ "preserve_original_event"
+ ]
+ },
+ {
+ "@timestamp": "2022-10-24T21:16:62.827288935Z",
+ "ecs": {
+ "version": "8.11.0"
+ },
+ "event": {
+ "category": [
+ "configuration"
+ ],
+ "kind": "asset",
+ "original": "{\"id\": 2,\"url\": \"http://localhost:8000/api/ipam/ip-addresses/2/\",\"display_url\": \"http://localhost:8000/ipam/ip-addresses/2/\",\"display\": \"192.168.1.101/32\",\"family\": {\"value\": 4,\"label\": \"IPv4\"},\"address\": \"192.168.1.101/32\",\"vrf\": {\"id\": 1,\"url\": \"http://localhost:8000/api/ipam/vrfs/1/\",\"display\": \"test\",\"name\": \"test\",\"rd\": null,\"description\": \"asdf\"},\"tenant\": {\"id\": 1,\"url\": \"http://localhost:8000/api/tenancy/tenants/1/\",\"display\": \"tenant-1\",\"name\": \"tenant-1\",\"slug\": \"tenant-1\",\"description\": \"first tenant\"},\"status\": {\"value\": \"active\",\"label\": \"Active\"},\"role\": {\"value\": \"secondary\",\"label\": \"Secondary\"},\"assigned_object_type\": \"dcim.interface\",\"assigned_object_id\": 2,\"assigned_object\": {\"id\": 2,\"url\": \"http://localhost:8000/api/dcim/interfaces/2/\",\"display\": \"hello\",\"device\": {\"id\": 1,\"url\": \"http://localhost:8000/api/dcim/devices/1/\",\"display\": \"user-1-macbook-pro (tag-1234)\",\"name\": \"user-1-macbook-pro\",\"description\": \"test-description\"},\"name\": \"hello\",\"description\": \"test-description\",\"cable\": null,\"_occupied\": false},\"nat_inside\": null,\"nat_outside\": [],\"dns_name\": \"hello.world\",\"description\": \"432rg\",\"comments\": \"\",\"tags\": [{\"id\": 4,\"url\": \"http://localhost:8000/api/extras/tags/4/\",\"display_url\": \"http://localhost:8000/extras/tags/4/\",\"display\": \"elastic\",\"name\": \"elastic\",\"slug\": \"elastic\",\"color\": \"ff9800\"}],\"custom_fields\": {},\"created\": \"2025-08-11T18:07:04.795476Z\",\"last_updated\": \"2025-08-11T18:07:04.795486Z\"}"
+ },
+ "netbox": {
+ "created": "2025-08-11T18:07:04.795Z",
+ "display": "192.168.1.101/32",
+ "display_url": "http://localhost:8000/ipam/ip-addresses/2/",
+ "ip": {
+ "address": "192.168.1.101",
+ "assigned_object": {
+ "_occupied": false,
+ "description": "test-description",
+ "device": {
+ "description": "test-description",
+ "display": "user-1-macbook-pro (tag-1234)",
+ "id": 1,
+ "name": "user-1-macbook-pro",
+ "url": "http://localhost:8000/api/dcim/devices/1/"
+ },
+ "display": "hello",
+ "id": 2,
+ "name": "hello",
+ "url": "http://localhost:8000/api/dcim/interfaces/2/"
+ },
+ "assigned_object_id": 2,
+ "assigned_object_type": "dcim.interface",
+ "description": "432rg",
+ "dns_name": "hello.world",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 2,
+ "role": {
+ "label": "Secondary",
+ "value": "secondary"
+ },
+ "status": {
+ "label": "Active",
+ "value": "active"
+ },
+ "vrf": {
+ "description": "asdf",
+ "display": "test",
+ "id": 1,
+ "name": "test",
+ "url": "http://localhost:8000/api/ipam/vrfs/1/"
+ }
+ },
+ "last_updated": "2025-08-11T18:07:04.795Z",
+ "tags": [
+ {
+ "color": "ff9800",
+ "display": "elastic",
+ "display_url": "http://localhost:8000/extras/tags/4/",
+ "id": 4,
+ "name": "elastic",
+ "slug": "elastic",
+ "url": "http://localhost:8000/api/extras/tags/4/"
+ }
+ ],
+ "tenant": {
+ "description": "first tenant",
+ "display": "tenant-1",
+ "id": 1,
+ "name": "tenant-1",
+ "slug": "tenant-1",
+ "url": "http://localhost:8000/api/tenancy/tenants/1/"
+ },
+ "url": "http://localhost:8000/api/ipam/ip-addresses/2/"
+ },
+ "related": {
+ "ip": [
+ "192.168.1.101"
+ ]
+ },
+ "tags": [
+ "preserve_original_event"
+ ]
+ }
+ ]
+}
diff --git a/packages/netbox/data_stream/ips/_dev/test/system/test-default-config.yml b/packages/netbox/data_stream/ips/_dev/test/system/test-default-config.yml
new file mode 100644
index 00000000000..91b2412d400
--- /dev/null
+++ b/packages/netbox/data_stream/ips/_dev/test/system/test-default-config.yml
@@ -0,0 +1,12 @@
+input: httpjson
+service: netbox_mock
+vars:
+ url: http://{{Hostname}}:{{Port}}
+ token: --token--
+ enable_request_tracer: true
+data_stream:
+ vars:
+ preserve_original_event: true
+ limit: 1
+assert:
+ hit_count: 2
diff --git a/packages/netbox/data_stream/ips/agent/stream/httpjson.yml.hbs b/packages/netbox/data_stream/ips/agent/stream/httpjson.yml.hbs
new file mode 100644
index 00000000000..4ace22b7efe
--- /dev/null
+++ b/packages/netbox/data_stream/ips/agent/stream/httpjson.yml.hbs
@@ -0,0 +1,54 @@
+config_version: 2
+interval: {{interval}}
+{{#if enable_request_tracer}}
+request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson"
+request.tracer.maxbackups: 5
+{{/if}}
+request.url: {{url}}/api/ipam/ip-addresses
+request.method: GET
+{{#if proxy_url }}
+request.proxy_url: {{proxy_url}}
+{{/if}}
+{{#if ssl}}
+request.ssl: {{ssl}}
+{{/if}}
+{{#if http_client_timeout}}
+request.timeout: {{http_client_timeout}}
+{{/if}}
+request.transforms:
+ - set:
+ target: "header.Content-Type"
+ value: "application/json"
+ - set:
+ target: "header.User-Agent"
+ value: "NetBox-Elastic-Filebeat/0.1.0"
+ - set:
+ target: "header.Authorization"
+ value: 'Token {{token}}'
+ - set:
+ target: "url.params.limit"
+ value: '{{limit}}'
+response.decode_as: application/json
+response.split:
+ target: body.results
+ ignore_empty_value: true
+response.pagination:
+ - set:
+ target: url.value
+ value: '[[if index .last_response.body "next"]][[.last_response.body.next]][[end]]'
+ fail_on_template_error: true
+
+tags:
+{{#if preserve_original_event}}
+ - preserve_original_event
+{{/if}}
+{{#each tags as |tag|}}
+ - {{tag}}
+{{/each}}
+{{#contains "forwarded" tags}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+{{#if processors}}
+processors:
+{{processors}}
+{{/if}}
diff --git a/packages/netbox/data_stream/ips/elasticsearch/ingest_pipeline/default.yml b/packages/netbox/data_stream/ips/elasticsearch/ingest_pipeline/default.yml
new file mode 100644
index 00000000000..25151de8b95
--- /dev/null
+++ b/packages/netbox/data_stream/ips/elasticsearch/ingest_pipeline/default.yml
@@ -0,0 +1,138 @@
+---
+description: Pipeline for processing ip addresses
+processors:
+ - set:
+ field: ecs.version
+ tag: set_ecs_version
+ value: 8.11.0
+ - rename:
+ field: message
+ target_field: event.original
+ ignore_missing: true
+ if: ctx.event?.original == null
+ - remove:
+ field: message
+ ignore_missing: true
+ tag: remove_message
+ if: ctx.event?.original != null
+ - json:
+ field: event.original
+ target_field: netbox.ip
+ - gsub:
+ field: netbox.ip.address
+ pattern: "/\\d+$"
+ replacement: ""
+ - append:
+ field: related.ip
+ value: "{{{netbox.ip.address}}}"
+ allow_duplicates: false
+ - gsub:
+ field: netbox.ip.nat_inside.address
+ pattern: "/\\d+$"
+ replacement: ""
+ ignore_missing: true
+ - append:
+ field: related.ip
+ value: "{{{netbox.ip.nat_inside.address}}}"
+ if: ctx.netbox?.ip?.nat_inside?.address != null
+ allow_duplicates: false
+ - foreach:
+ field: netbox.ip.nat_outside
+ ignore_missing: true
+ processor:
+ gsub:
+ field: _ingest._value.address
+ pattern: "/\\d+$"
+ replacement: ""
+ ignore_missing: true
+ - foreach:
+ field: netbox.ip.nat_outside
+ ignore_missing: true
+ processor:
+ append:
+ field: related.ip
+ value: "{{{_ingest._value.address}}}"
+ if: ctx._ingest?._value != null
+ allow_duplicates: false
+ - rename:
+ field: netbox.ip.url
+ target_field: netbox.url
+ ignore_missing: true
+ - rename:
+ field: netbox.ip.display_url
+ target_field: netbox.display_url
+ ignore_missing: true
+ - rename:
+ field: netbox.ip.display
+ target_field: netbox.display
+ ignore_missing: true
+ - rename:
+ field: netbox.ip.comments
+ target_field: netbox.comments
+ ignore_missing: true
+ - rename:
+ field: netbox.ip.created
+ target_field: netbox.created
+ ignore_missing: true
+ - rename:
+ field: netbox.ip.last_updated
+ target_field: netbox.last_updated
+ ignore_missing: true
+ - rename:
+ field: netbox.ip.custom_fields
+ target_field: netbox.custom_fields
+ ignore_missing: true
+ - rename:
+ field: netbox.ip.tags
+ target_field: netbox.tags
+ ignore_missing: true
+ - rename:
+ field: netbox.ip.tenant
+ target_field: netbox.tenant
+ ignore_missing: true
+ - set:
+ field: event.kind
+ value: asset
+ - append:
+ field: event.category
+ value: [configuration]
+ - date:
+ field: netbox.created
+ target_field: netbox.created
+ if: ctx.netbox?.created != null
+ formats:
+ - ISO8601
+ - date:
+ field: netbox.last_updated
+ target_field: netbox.last_updated
+ if: ctx.netbox?.last_updated != null
+ formats:
+ - ISO8601
+ - script:
+ description: Drops null/empty values recursively.
+ lang: painless
+ source: |
+ boolean dropEmptyFields(Object object) {
+ if (object == null || object == "") {
+ return true;
+ } else if (object instanceof Map) {
+ ((Map) object).values().removeIf(value -> dropEmptyFields(value));
+ return (((Map) object).size() == 0);
+ } else if (object instanceof List) {
+ ((List) object).removeIf(value -> dropEmptyFields(value));
+ return (((List) object).length == 0);
+ }
+ return false;
+ }
+ dropEmptyFields(ctx);
+on_failure:
+ - set:
+ field: event.kind
+ value: pipeline_error
+ - append:
+ field: tags
+ value: preserve_original_event
+ allow_duplicates: false
+ - append:
+ field: error.message
+ value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
diff --git a/packages/netbox/data_stream/ips/fields/base-fields.yml b/packages/netbox/data_stream/ips/fields/base-fields.yml
new file mode 100644
index 00000000000..69e6cd8e7a6
--- /dev/null
+++ b/packages/netbox/data_stream/ips/fields/base-fields.yml
@@ -0,0 +1,15 @@
+- name: data_stream.type
+ type: constant_keyword
+ description: Data stream type.
+- name: data_stream.dataset
+ type: constant_keyword
+ description: Data stream dataset.
+- name: data_stream.namespace
+ type: constant_keyword
+ description: Data stream namespace.
+- name: '@timestamp'
+ type: date
+ description: Event timestamp.
+- name: input.type
+ type: keyword
+ description: Input type
diff --git a/packages/netbox/data_stream/ips/fields/fields.yml b/packages/netbox/data_stream/ips/fields/fields.yml
new file mode 100644
index 00000000000..830843aa73b
--- /dev/null
+++ b/packages/netbox/data_stream/ips/fields/fields.yml
@@ -0,0 +1,237 @@
+- name: netbox
+ type: group
+ fields:
+ - name: url
+ type: keyword
+ description: The API URL for the IP address.
+ - name: display_url
+ type: keyword
+ description: The web UI URL for the IP address.
+ - name: display
+ type: keyword
+ description: The display name of the IP address.
+ - name: comments
+ type: text
+ description: User-provided comments for the IP address.
+ - name: created
+ type: date
+ description: The timestamp when the IP address was created.
+ - name: last_updated
+ type: date
+ description: The timestamp when the IP address was last updated.
+ - name: custom_fields
+ type: object
+ object_type: keyword
+ object_type_mapping_type: "*"
+ description: Custom fields configured for the IP address.
+ - name: tags
+ type: nested
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the tag.
+ - name: url
+ type: keyword
+ description: The API URL for the tag.
+ - name: display_url
+ type: keyword
+ description: The display URL for the tag.
+ - name: display
+ type: keyword
+ description: The display name of the tag.
+ - name: name
+ type: keyword
+ description: The name of the tag.
+ - name: slug
+ type: keyword
+ description: The slug of the tag.
+ - name: color
+ type: keyword
+ description: The color code of the tag.
+ - name: tenant
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the tenant.
+ - name: url
+ type: keyword
+ description: The API URL for the tenant.
+ - name: display
+ type: keyword
+ description: The display name of the tenant.
+ - name: name
+ type: keyword
+ description: The name of the tenant.
+ - name: slug
+ type: keyword
+ description: The slug of the tenant.
+ - name: description
+ type: text
+ description: The description of the tenant.
+ - name: ip
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique numeric identifier for the IP address.
+ - name: family
+ type: group
+ fields:
+ - name: value
+ type: long
+ description: The IP family value (4 for IPv4, 6 for IPv6).
+ - name: label
+ type: keyword
+ description: The IP family label (IPv4 or IPv6).
+ - name: address
+ type: ip
+ description: The IP address in CIDR notation.
+ - name: vrf
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the VRF.
+ - name: url
+ type: keyword
+ description: The API URL for the VRF.
+ - name: display
+ type: keyword
+ description: The display name of the VRF.
+ - name: name
+ type: keyword
+ description: The name of the VRF.
+ - name: rd
+ type: keyword
+ description: The route distinguisher of the VRF.
+ - name: description
+ type: text
+ description: The description of the VRF.
+ - name: status
+ type: group
+ fields:
+ - name: value
+ type: keyword
+ description: The status value of the IP address.
+ - name: label
+ type: keyword
+ description: The status label of the IP address.
+ - name: role
+ type: group
+ fields:
+ - name: value
+ type: keyword
+ description: The role value of the IP address.
+ - name: label
+ type: keyword
+ description: The role label of the IP address.
+ - name: assigned_object_type
+ type: keyword
+ description: The type of object this IP address is assigned to.
+ - name: assigned_object_id
+ type: long
+ description: The unique identifier of the assigned object.
+ - name: assigned_object
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the assigned object.
+ - name: url
+ type: keyword
+ description: The API URL for the assigned object.
+ - name: display
+ type: keyword
+ description: The display name of the assigned object.
+ - name: virtual_machine
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the virtual machine.
+ - name: url
+ type: keyword
+ description: The API URL for the virtual machine.
+ - name: display
+ type: keyword
+ description: The display name of the virtual machine.
+ - name: name
+ type: keyword
+ description: The name of the virtual machine.
+ - name: description
+ type: text
+ description: The description of the virtual machine.
+ - name: device
+ type: group
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the device.
+ - name: url
+ type: keyword
+ description: The API URL for the device.
+ - name: display
+ type: keyword
+ description: The display name of the device.
+ - name: name
+ type: keyword
+ description: The name of the device.
+ - name: description
+ type: text
+ description: The description of the device.
+ - name: name
+ type: keyword
+ description: The name of the assigned object (interface).
+ - name: description
+ type: text
+ description: The description of the assigned object.
+ - name: cable
+ type: keyword
+ description: The cable connection information.
+ - name: _occupied
+ type: boolean
+ description: Whether the interface is occupied.
+ - name: nat_inside
+ type: group
+ fields:
+ - name: id
+ type: long
+ - name: url
+ type: keyword
+ - name: address
+ type: ip
+ - name: display
+ type: keyword
+ - name: display_url
+ type: keyword
+ - name: family
+ type: long
+ description: The NAT inside IP address reference.
+ - name: nat_outside
+ type: nested
+ fields:
+ - name: id
+ type: long
+ description: The unique identifier of the NAT outside IP address.
+ - name: url
+ type: keyword
+ description: The API URL for the NAT outside IP address.
+ - name: address
+ type: ip
+ description: The NAT outside IP address.
+ - name: display
+ type: keyword
+ description: The display name of the NAT outside IP address.
+ - name: display_url
+ type: keyword
+ description: The web UI URL for the NAT outside IP address.
+ - name: family
+ type: long
+ description: The IP family value (4 for IPv4, 6 for IPv6).
+ - name: dns_name
+ type: keyword
+ description: The DNS name associated with the IP address.
+ - name: description
+ type: text
+ description: The description of the IP address.
diff --git a/packages/netbox/data_stream/ips/manifest.yml b/packages/netbox/data_stream/ips/manifest.yml
new file mode 100644
index 00000000000..3fedd618c69
--- /dev/null
+++ b/packages/netbox/data_stream/ips/manifest.yml
@@ -0,0 +1,47 @@
+title: "IPs"
+type: logs
+streams:
+ - input: httpjson
+ title: "Collect NetBox IP Addresses"
+ description: "Collect ip addresses from NetBox via the NetBox API"
+ enabled: true
+ template_path: httpjson.yml.hbs
+ vars:
+ - name: limit
+ type: integer
+ title: Limit
+ description: Number of events to fetch on each request
+ show_user: false
+ required: true
+ default: 50
+ - name: interval
+ type: text
+ title: Interval to query NetBox API
+ description: Go Duration syntax (eg. 10s)
+ show_user: false
+ required: true
+ default: 1h
+ - name: tags
+ type: text
+ title: Tags
+ multi: true
+ show_user: false
+ default:
+ - forwarded
+ - netbox-ips
+ - name: preserve_original_event
+ required: true
+ show_user: true
+ title: Preserve original event
+ description: Preserves a raw copy of the original event, added to the field `event.original`
+ type: bool
+ multi: false
+ default: false
+ - name: processors
+ type: yaml
+ title: Processors
+ multi: false
+ required: false
+ show_user: false
+ description: >-
+ Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
diff --git a/packages/netbox/data_stream/ips/sample_event.json b/packages/netbox/data_stream/ips/sample_event.json
new file mode 100644
index 00000000000..1b1068a2d6f
--- /dev/null
+++ b/packages/netbox/data_stream/ips/sample_event.json
@@ -0,0 +1,127 @@
+{
+ "@timestamp": "2025-11-19T16:30:17.238Z",
+ "agent": {
+ "ephemeral_id": "aa94dc52-91c8-4549-a2d7-2d2c9ad0ff46",
+ "id": "edba1e8a-5a84-4b40-804b-9cb97eac5bd7",
+ "name": "elastic-agent-48422",
+ "type": "filebeat",
+ "version": "9.2.1"
+ },
+ "data_stream": {
+ "dataset": "netbox.ips",
+ "namespace": "82567",
+ "type": "logs"
+ },
+ "ecs": {
+ "version": "8.11.0"
+ },
+ "elastic_agent": {
+ "id": "edba1e8a-5a84-4b40-804b-9cb97eac5bd7",
+ "snapshot": false,
+ "version": "9.2.1"
+ },
+ "event": {
+ "agent_id_status": "verified",
+ "category": [
+ "configuration"
+ ],
+ "created": "2025-11-19T16:30:17.238Z",
+ "dataset": "netbox.ips",
+ "ingested": "2025-11-19T16:30:20Z",
+ "kind": "asset",
+ "original": "{\"address\":\"192.168.1.101/32\",\"assigned_object\":{\"_occupied\":false,\"cable\":null,\"description\":\"test-description\",\"device\":{\"description\":\"test-description\",\"display\":\"user-1-macbook-pro (tag-1234)\",\"id\":1,\"name\":\"user-1-macbook-pro\",\"url\":\"http://localhost:8000/api/dcim/devices/1/\"},\"display\":\"hello\",\"id\":2,\"name\":\"user-hello\",\"url\":\"http://localhost:8000/api/dcim/interfaces/2/\"},\"assigned_object_id\":2,\"assigned_object_type\":\"dcim.interface\",\"comments\":\"\",\"created\":\"2025-08-11T18:07:04.795476Z\",\"custom_fields\":{},\"description\":\"desc\",\"display\":\"192.168.1.101/32\",\"display_url\":\"http://localhost:8000/ipam/ip-addresses/2/\",\"dns_name\":\"hello.world\",\"family\":{\"label\":\"IPv4\",\"value\":4},\"id\":2,\"last_updated\":\"2025-08-11T18:07:04.795486Z\",\"nat_inside\":null,\"nat_outside\":[],\"role\":{\"label\":\"Secondary\",\"value\":\"secondary\"},\"status\":{\"label\":\"Active\",\"value\":\"active\"},\"tags\":[{\"color\":\"ff9800\",\"display\":\"elastic\",\"display_url\":\"http://localhost:8000/extras/tags/4/\",\"id\":4,\"name\":\"elastic\",\"slug\":\"elastic\",\"url\":\"http://localhost:8000/api/extras/tags/4/\"}],\"tenant\":{\"description\":\"first tenant\",\"display\":\"tenant-1\",\"id\":1,\"name\":\"tenant-1\",\"slug\":\"tenant-1\",\"url\":\"http://localhost:8000/api/tenancy/tenants/1/\"},\"url\":\"http://localhost:8000/api/ipam/ip-addresses/2/\",\"vrf\":{\"description\":\"asdf\",\"display\":\"test\",\"id\":1,\"name\":\"test\",\"rd\":null,\"url\":\"http://localhost:8000/api/ipam/vrfs/1/\"}}"
+ },
+ "input": {
+ "type": "httpjson"
+ },
+ "netbox": {
+ "created": "2025-08-11T18:07:04.795Z",
+ "display": "192.168.1.101/32",
+ "display_url": "http://localhost:8000/ipam/ip-addresses/2/",
+ "ip": {
+ "address": "192.168.1.101",
+ "assigned_object": {
+ "_occupied": false,
+ "description": "test-description",
+ "device": {
+ "description": "test-description",
+ "display": "user-1-macbook-pro (tag-1234)",
+ "id": 1,
+ "name": "user-1-macbook-pro",
+ "url": "http://localhost:8000/api/dcim/devices/1/"
+ },
+ "display": "hello",
+ "id": 2,
+ "name": "user-hello",
+ "url": "http://localhost:8000/api/dcim/interfaces/2/"
+ },
+ "assigned_object_id": 2,
+ "assigned_object_type": "dcim.interface",
+ "description": "desc",
+ "dns_name": "hello.world",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 2,
+ "role": {
+ "label": "Secondary",
+ "value": "secondary"
+ },
+ "status": {
+ "label": "Active",
+ "value": "active"
+ },
+ "vrf": {
+ "description": "asdf",
+ "display": "test",
+ "id": 1,
+ "name": "test",
+ "url": "http://localhost:8000/api/ipam/vrfs/1/"
+ }
+ },
+ "last_updated": "2025-08-11T18:07:04.795Z",
+ "tags": {
+ "color": [
+ "ff9800"
+ ],
+ "display": [
+ "elastic"
+ ],
+ "display_url": [
+ "http://localhost:8000/extras/tags/4/"
+ ],
+ "id": [
+ 4
+ ],
+ "name": [
+ "elastic"
+ ],
+ "slug": [
+ "elastic"
+ ],
+ "url": [
+ "http://localhost:8000/api/extras/tags/4/"
+ ]
+ },
+ "tenant": {
+ "description": "first tenant",
+ "display": "tenant-1",
+ "id": 1,
+ "name": "tenant-1",
+ "slug": "tenant-1",
+ "url": "http://localhost:8000/api/tenancy/tenants/1/"
+ },
+ "url": "http://localhost:8000/api/ipam/ip-addresses/2/"
+ },
+ "related": {
+ "ip": [
+ "192.168.1.101"
+ ]
+ },
+ "tags": [
+ "preserve_original_event",
+ "forwarded",
+ "netbox-ips"
+ ]
+}
diff --git a/packages/netbox/docs/README.md b/packages/netbox/docs/README.md
new file mode 100644
index 00000000000..440a027af0f
--- /dev/null
+++ b/packages/netbox/docs/README.md
@@ -0,0 +1,711 @@
+# NetBox Integration
+
+This integration is for [NetBox](). It currently supports retrieving devices and ip addresses from the NetBox API.
+
+## Setup
+
+Retrieve an [API token](https://netboxlabs.com/docs/netbox/integrations/rest-api/#initial-token-provisioning) from your NetBox Server and update the URL to your NetBox Server.
+
+## Compatibility
+
+The NetBox module has been developed with and tested against the [community edition](https://github.com/netbox-community/netbox) version 4.3.5
+
+## Logs
+
+### Devices
+
+Collects devices from the [Devices API](https://demo.netbox.dev/api/schema/swagger-ui/#/dcim/dcim_devices_list).
+
+An example event for `devices` looks as following:
+
+```json
+{
+ "@timestamp": "2025-11-19T16:29:30.984Z",
+ "agent": {
+ "ephemeral_id": "26808a50-5696-4206-86b9-3f8f56d7dd48",
+ "id": "c17ce5b2-739e-4040-a21c-79a45b4570fe",
+ "name": "elastic-agent-89017",
+ "type": "filebeat",
+ "version": "9.2.1"
+ },
+ "data_stream": {
+ "dataset": "netbox.devices",
+ "namespace": "89710",
+ "type": "logs"
+ },
+ "ecs": {
+ "version": "8.11.0"
+ },
+ "elastic_agent": {
+ "id": "c17ce5b2-739e-4040-a21c-79a45b4570fe",
+ "snapshot": false,
+ "version": "9.2.1"
+ },
+ "event": {
+ "agent_id_status": "verified",
+ "category": [
+ "configuration"
+ ],
+ "created": "2025-11-19T16:29:30.984Z",
+ "dataset": "netbox.devices",
+ "ingested": "2025-11-19T16:29:33Z",
+ "kind": "asset",
+ "original": "{\"airflow\":{\"label\":\"Front to rear\",\"value\":\"front-to-rear\"},\"asset_tag\":\"WEB-001\",\"cluster\":{\"description\":\"Production web application cluster\",\"display\":\"web-cluster\",\"id\":1,\"name\":\"web-cluster\",\"url\":\"http://localhost:8000/api/virtualization/clusters/1/\"},\"comments\":\"\",\"config_context\":{\"backup_enabled\":true,\"environment\":\"production\"},\"config_template\":{\"description\":\"Standard Ubuntu web server configuration template\",\"display\":\"ubuntu-web-template\",\"id\":1,\"name\":\"ubuntu-web-template\",\"url\":\"http://localhost:8000/api/extras/config-templates/1/\"},\"console_port_count\":0,\"console_server_port_count\":0,\"created\":\"2025-08-11T14:37:28.180540Z\",\"custom_fields\":{\"maintenance_window\":\"Sunday 02:00-04:00 EST\"},\"description\":\"Primary web server for customer portal\",\"device_bay_count\":0,\"device_type\":{\"description\":\"Dell PowerEdge R740 2U Rack Server\",\"display\":\"dell poweredge r740\",\"id\":1,\"manufacturer\":{\"description\":\"\",\"display\":\"Dell\",\"id\":1,\"name\":\"Dell\",\"slug\":\"dell\",\"url\":\"http://localhost:8000/api/dcim/manufacturers/1/\"},\"model\":\"poweredge r740\",\"slug\":\"poweredge-r740\",\"url\":\"http://localhost:8000/api/dcim/device-types/1/\"},\"display\":\"web-srv-01 (WEB-001)\",\"display_url\":\"http://localhost:8000/dcim/devices/2/\",\"face\":{\"label\":\"Front\",\"value\":\"front\"},\"front_port_count\":0,\"id\":2,\"interface_count\":4,\"inventory_item_count\":0,\"last_updated\":\"2025-08-11T18:12:23.512163Z\",\"latitude\":39.0458,\"local_context_data\":{\"monitoring\":\"enabled\",\"ssl_cert\":\"wildcard.acme.com\"},\"location\":{\"_depth\":0,\"description\":\"Primary server room - Zone A\",\"display\":\"server-room-a\",\"id\":1,\"name\":\"server-room-a\",\"rack_count\":0,\"slug\":\"server-room-a\",\"url\":\"http://localhost:8000/api/dcim/locations/1/\"},\"longitude\":-76.6413,\"module_bay_count\":0,\"name\":\"web-srv-01\",\"oob_ip\":{\"address\":\"10.0.100.15/24\",\"description\":\"Out-of-band management interface\",\"display\":\"10.0.100.15/24\",\"family\":{\"label\":\"IPv4\",\"value\":4},\"id\":1,\"url\":\"http://localhost:8000/api/ipam/ip-addresses/1/\"},\"parent_device\":null,\"platform\":{\"description\":\"Ubuntu Server 22.04 LTS\",\"display\":\"ubuntu-server\",\"id\":1,\"name\":\"ubuntu-server\",\"slug\":\"ubuntu-server\",\"url\":\"http://localhost:8000/api/dcim/platforms/1/\"},\"position\":15,\"power_outlet_count\":0,\"power_port_count\":2,\"primary_ip\":{\"address\":\"10.0.1.15/24\",\"description\":\"Primary web server interface\",\"display\":\"10.0.1.15/24\",\"family\":{\"label\":\"IPv4\",\"value\":4},\"id\":1,\"url\":\"http://localhost:8000/api/ipam/ip-addresses/1/\"},\"primary_ip4\":{\"address\":\"10.0.1.15/24\",\"description\":\"Primary web server interface\",\"display\":\"10.0.1.15/24\",\"family\":{\"label\":\"IPv4\",\"value\":4},\"id\":1,\"url\":\"http://localhost:8000/api/ipam/ip-addresses/1/\"},\"primary_ip6\":null,\"rack\":{\"description\":\"42U server rack - Zone A, Row 1\",\"display\":\"rack-a01 (DC-EAST-A01)\",\"id\":1,\"name\":\"rack-a01\",\"url\":\"http://localhost:8000/api/dcim/racks/1/\"},\"rear_port_count\":0,\"role\":{\"_depth\":0,\"description\":\"\",\"display\":\"web-server\",\"id\":1,\"name\":\"web-server\",\"slug\":\"web-server\",\"url\":\"http://localhost:8000/api/dcim/device-roles/1/\"},\"serial\":\"CN7016A2B90001\",\"site\":{\"description\":\"\",\"display\":\"datacenter-east\",\"id\":1,\"name\":\"datacenter-east\",\"slug\":\"datacenter-east\",\"url\":\"http://localhost:8000/api/dcim/sites/1/\"},\"status\":{\"label\":\"Active\",\"value\":\"active\"},\"tags\":[{\"color\":\"4caf50\",\"display\":\"production\",\"display_url\":\"http://localhost:8000/extras/tags/2/\",\"id\":2,\"name\":\"production\",\"slug\":\"production\",\"url\":\"http://localhost:8000/api/extras/tags/2/\"},{\"color\":\"2196f3\",\"display\":\"web-tier\",\"display_url\":\"http://localhost:8000/extras/tags/4/\",\"id\":4,\"name\":\"web-tier\",\"slug\":\"web-tier\",\"url\":\"http://localhost:8000/api/extras/tags/4/\"},{\"color\":\"f44336\",\"display\":\"critical\",\"display_url\":\"http://localhost:8000/extras/tags/1/\",\"id\":1,\"name\":\"critical\",\"slug\":\"critical\",\"url\":\"http://localhost:8000/api/extras/tags/1/\"},{\"color\":\"ff9800\",\"display\":\"monitored\",\"display_url\":\"http://localhost:8000/extras/tags/3/\",\"id\":3,\"name\":\"monitored\",\"slug\":\"monitored\",\"url\":\"http://localhost:8000/api/extras/tags/3/\"}],\"tenant\":{\"description\":\"Acme Corporation primary tenant\",\"display\":\"acme-corp\",\"id\":1,\"name\":\"acme-corp\",\"slug\":\"acme-corp\",\"url\":\"http://localhost:8000/api/tenancy/tenants/1/\"},\"url\":\"http://localhost:8000/api/dcim/devices/2/\",\"vc_position\":1,\"vc_priority\":null,\"virtual_chassis\":{\"description\":\"\",\"display\":\"web-cluster-vc\",\"id\":1,\"master\":{\"display\":\"web-srv-01 (WEB-001)\",\"display_url\":\"http://localhost:8000/dcim/devices/2/\",\"id\":2,\"name\":\"web-srv-01\",\"url\":\"http://localhost:8000/api/dcim/devices/2/\"},\"member_count\":2,\"name\":\"web-cluster-vc\",\"url\":\"http://localhost:8000/api/dcim/virtual-chassis/1/\"}}"
+ },
+ "input": {
+ "type": "httpjson"
+ },
+ "netbox": {
+ "created": "2025-08-11T14:37:28.180Z",
+ "custom_fields": {
+ "maintenance_window": "Sunday 02:00-04:00 EST"
+ },
+ "device": {
+ "airflow": {
+ "label": "Front to rear",
+ "value": "front-to-rear"
+ },
+ "asset_tag": "WEB-001",
+ "cluster": {
+ "description": "Production web application cluster",
+ "display": "web-cluster",
+ "id": 1,
+ "name": "web-cluster",
+ "url": "http://localhost:8000/api/virtualization/clusters/1/"
+ },
+ "config_context": {
+ "backup_enabled": "true",
+ "environment": "production"
+ },
+ "config_template": {
+ "description": "Standard Ubuntu web server configuration template",
+ "display": "ubuntu-web-template",
+ "id": 1,
+ "name": "ubuntu-web-template",
+ "url": "http://localhost:8000/api/extras/config-templates/1/"
+ },
+ "console_port_count": 0,
+ "console_server_port_count": 0,
+ "coordinates": [
+ -76.6413,
+ 39.0458
+ ],
+ "description": "Primary web server for customer portal",
+ "device_bay_count": 0,
+ "device_type": {
+ "description": "Dell PowerEdge R740 2U Rack Server",
+ "display": "dell poweredge r740",
+ "id": 1,
+ "manufacturer": {
+ "display": "Dell",
+ "id": 1,
+ "name": "Dell",
+ "slug": "dell",
+ "url": "http://localhost:8000/api/dcim/manufacturers/1/"
+ },
+ "model": "poweredge r740",
+ "slug": "poweredge-r740",
+ "url": "http://localhost:8000/api/dcim/device-types/1/"
+ },
+ "face": {
+ "label": "Front",
+ "value": "front"
+ },
+ "front_port_count": 0,
+ "id": 2,
+ "interface_count": 4,
+ "inventory_item_count": 0,
+ "local_context_data": {
+ "monitoring": "enabled",
+ "ssl_cert": "wildcard.acme.com"
+ },
+ "location": {
+ "_depth": 0,
+ "description": "Primary server room - Zone A",
+ "display": "server-room-a",
+ "id": 1,
+ "name": "server-room-a",
+ "rack_count": 0,
+ "slug": "server-room-a",
+ "url": "http://localhost:8000/api/dcim/locations/1/"
+ },
+ "module_bay_count": 0,
+ "name": "web-srv-01",
+ "oob_ip": {
+ "address": "10.0.100.15",
+ "description": "Out-of-band management interface",
+ "display": "10.0.100.15/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "platform": {
+ "description": "Ubuntu Server 22.04 LTS",
+ "display": "ubuntu-server",
+ "id": 1,
+ "name": "ubuntu-server",
+ "slug": "ubuntu-server",
+ "url": "http://localhost:8000/api/dcim/platforms/1/"
+ },
+ "position": 15,
+ "power_outlet_count": 0,
+ "power_port_count": 2,
+ "primary_ip": {
+ "address": "10.0.1.15",
+ "description": "Primary web server interface",
+ "display": "10.0.1.15/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "primary_ip4": {
+ "address": "10.0.1.15",
+ "description": "Primary web server interface",
+ "display": "10.0.1.15/24",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 1,
+ "url": "http://localhost:8000/api/ipam/ip-addresses/1/"
+ },
+ "rack": {
+ "description": "42U server rack - Zone A, Row 1",
+ "display": "rack-a01 (DC-EAST-A01)",
+ "id": 1,
+ "name": "rack-a01",
+ "url": "http://localhost:8000/api/dcim/racks/1/"
+ },
+ "rear_port_count": 0,
+ "role": {
+ "_depth": 0,
+ "display": "web-server",
+ "id": 1,
+ "name": "web-server",
+ "slug": "web-server",
+ "url": "http://localhost:8000/api/dcim/device-roles/1/"
+ },
+ "serial": "CN7016A2B90001",
+ "site": {
+ "display": "datacenter-east",
+ "id": 1,
+ "name": "datacenter-east",
+ "slug": "datacenter-east",
+ "url": "http://localhost:8000/api/dcim/sites/1/"
+ },
+ "status": {
+ "label": "Active",
+ "value": "active"
+ },
+ "vc_position": 1,
+ "virtual_chassis": {
+ "display": "web-cluster-vc",
+ "id": 1,
+ "master": {
+ "display": "web-srv-01 (WEB-001)",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "id": 2,
+ "name": "web-srv-01",
+ "url": "http://localhost:8000/api/dcim/devices/2/"
+ },
+ "member_count": 2,
+ "name": "web-cluster-vc",
+ "url": "http://localhost:8000/api/dcim/virtual-chassis/1/"
+ }
+ },
+ "display": "web-srv-01 (WEB-001)",
+ "display_url": "http://localhost:8000/dcim/devices/2/",
+ "last_updated": "2025-08-11T18:12:23.512Z",
+ "tags": [
+ {
+ "color": [
+ "4caf50"
+ ],
+ "display": [
+ "production"
+ ],
+ "display_url": [
+ "http://localhost:8000/extras/tags/2/"
+ ],
+ "id": [
+ 2
+ ],
+ "name": [
+ "production"
+ ],
+ "slug": [
+ "production"
+ ],
+ "url": [
+ "http://localhost:8000/api/extras/tags/2/"
+ ]
+ },
+ {
+ "color": [
+ "2196f3"
+ ],
+ "display": [
+ "web-tier"
+ ],
+ "display_url": [
+ "http://localhost:8000/extras/tags/4/"
+ ],
+ "id": [
+ 4
+ ],
+ "name": [
+ "web-tier"
+ ],
+ "slug": [
+ "web-tier"
+ ],
+ "url": [
+ "http://localhost:8000/api/extras/tags/4/"
+ ]
+ },
+ {
+ "color": [
+ "f44336"
+ ],
+ "display": [
+ "critical"
+ ],
+ "display_url": [
+ "http://localhost:8000/extras/tags/1/"
+ ],
+ "id": [
+ 1
+ ],
+ "name": [
+ "critical"
+ ],
+ "slug": [
+ "critical"
+ ],
+ "url": [
+ "http://localhost:8000/api/extras/tags/1/"
+ ]
+ },
+ {
+ "color": [
+ "ff9800"
+ ],
+ "display": [
+ "monitored"
+ ],
+ "display_url": [
+ "http://localhost:8000/extras/tags/3/"
+ ],
+ "id": [
+ 3
+ ],
+ "name": [
+ "monitored"
+ ],
+ "slug": [
+ "monitored"
+ ],
+ "url": [
+ "http://localhost:8000/api/extras/tags/3/"
+ ]
+ }
+ ],
+ "tenant": {
+ "description": "Acme Corporation primary tenant",
+ "display": "acme-corp",
+ "id": 1,
+ "name": "acme-corp",
+ "slug": "acme-corp",
+ "url": "http://localhost:8000/api/tenancy/tenants/1/"
+ },
+ "url": "http://localhost:8000/api/dcim/devices/2/"
+ },
+ "related": {
+ "ip": [
+ "10.0.1.15",
+ "10.0.100.15"
+ ]
+ },
+ "tags": [
+ "preserve_original_event",
+ "forwarded",
+ "netbox-devices"
+ ]
+}
+```
+
+**Exported fields**
+
+| Field | Description | Type |
+|---|---|---|
+| @timestamp | Event timestamp. | date |
+| data_stream.dataset | Data stream dataset. | constant_keyword |
+| data_stream.namespace | Data stream namespace. | constant_keyword |
+| data_stream.type | Data stream type. | constant_keyword |
+| input.type | Input type | keyword |
+| netbox.comments | User-provided comments for the device. | text |
+| netbox.created | The timestamp when the device was created. | date |
+| netbox.custom_fields | Custom fields configured for the device. | object |
+| netbox.device.airflow.label | The airflow label of the device. | keyword |
+| netbox.device.airflow.value | The airflow value of the device. | keyword |
+| netbox.device.asset_tag | The asset tag of the device. | keyword |
+| netbox.device.cluster.description | The description of the cluster. | text |
+| netbox.device.cluster.display | The display name of the cluster. | keyword |
+| netbox.device.cluster.id | The unique identifier of the cluster. | long |
+| netbox.device.cluster.name | The name of the cluster. | keyword |
+| netbox.device.cluster.url | The API URL for the cluster. | keyword |
+| netbox.device.config_context | The configuration context of the device. | object |
+| netbox.device.config_template.description | The description of the config template. | text |
+| netbox.device.config_template.display | The display name of the config template. | keyword |
+| netbox.device.config_template.id | The unique identifier of the config template. | long |
+| netbox.device.config_template.name | The name of the config template. | keyword |
+| netbox.device.config_template.url | The API URL for the config template. | keyword |
+| netbox.device.console_port_count | The number of console ports on the device. | long |
+| netbox.device.console_server_port_count | The number of console server ports on the device. | long |
+| netbox.device.coordinates | GPS coordinates in decimal format (longitude, latitude). | float |
+| netbox.device.description | The description of the device. | text |
+| netbox.device.device_bay_count | The number of device bays on the device. | long |
+| netbox.device.device_type.description | The description of the device type. | text |
+| netbox.device.device_type.display | The display name of the device type. | keyword |
+| netbox.device.device_type.id | The unique identifier of the device type. | long |
+| netbox.device.device_type.manufacturer.description | The description of the manufacturer. | text |
+| netbox.device.device_type.manufacturer.display | The display name of the manufacturer. | keyword |
+| netbox.device.device_type.manufacturer.id | The unique identifier of the manufacturer. | long |
+| netbox.device.device_type.manufacturer.name | The name of the manufacturer. | keyword |
+| netbox.device.device_type.manufacturer.slug | The slug of the manufacturer. | keyword |
+| netbox.device.device_type.manufacturer.url | The API URL for the manufacturer. | keyword |
+| netbox.device.device_type.model | The model of the device type. | keyword |
+| netbox.device.device_type.slug | The slug of the device type. | keyword |
+| netbox.device.device_type.url | The API URL for the device type. | keyword |
+| netbox.device.face.label | The label of the device face. | keyword |
+| netbox.device.face.value | The value of the device face. | keyword |
+| netbox.device.front_port_count | The number of front ports on the device. | long |
+| netbox.device.id | The unique numeric identifier for the device. | long |
+| netbox.device.interface_count | The number of interfaces on the device. | long |
+| netbox.device.inventory_item_count | The number of inventory items associated with the device. | long |
+| netbox.device.local_context_data | The local context data of the device. | object |
+| netbox.device.location._depth | The depth level of the location. | long |
+| netbox.device.location.description | The description of the location. | text |
+| netbox.device.location.display | The display name of the location. | keyword |
+| netbox.device.location.id | The unique identifier of the location. | long |
+| netbox.device.location.name | The name of the location. | keyword |
+| netbox.device.location.rack_count | The number of racks in the location. | long |
+| netbox.device.location.slug | The slug of the location. | keyword |
+| netbox.device.location.url | The API URL for the location. | keyword |
+| netbox.device.module_bay_count | The number of module bays on the device. | long |
+| netbox.device.name | The name of the device. | keyword |
+| netbox.device.oob_ip.address | The out-of-band IP address. | ip |
+| netbox.device.oob_ip.description | The description of the out-of-band IP address. | text |
+| netbox.device.oob_ip.display | The display name of the out-of-band IP address. | keyword |
+| netbox.device.oob_ip.family.label | The IP family label (IPv4 or IPv6). | keyword |
+| netbox.device.oob_ip.family.value | The IP family value (4 for IPv4, 6 for IPv6). | long |
+| netbox.device.oob_ip.id | The unique identifier of the out-of-band IP address. | long |
+| netbox.device.oob_ip.name | The name of the out-of-band IP address. | keyword |
+| netbox.device.oob_ip.url | The API URL for the out-of-band IP address. | keyword |
+| netbox.device.parent_device | The parent device identifier. | keyword |
+| netbox.device.platform.description | The description of the platform. | text |
+| netbox.device.platform.display | The display name of the platform. | keyword |
+| netbox.device.platform.id | The unique identifier of the platform. | long |
+| netbox.device.platform.name | The name of the platform. | keyword |
+| netbox.device.platform.slug | The slug of the platform. | keyword |
+| netbox.device.platform.url | The API URL for the platform. | keyword |
+| netbox.device.position | The position of the device in the rack. | long |
+| netbox.device.power_outlet_count | The number of power outlets on the device. | long |
+| netbox.device.power_port_count | The number of power ports on the device. | long |
+| netbox.device.primary_ip.address | The primary IP address. | ip |
+| netbox.device.primary_ip.description | The description of the primary IP address. | text |
+| netbox.device.primary_ip.display | The display name of the primary IP address. | keyword |
+| netbox.device.primary_ip.family.label | The IP family label (IPv4 or IPv6). | keyword |
+| netbox.device.primary_ip.family.value | The IP family value (4 for IPv4, 6 for IPv6). | long |
+| netbox.device.primary_ip.id | The unique identifier of the primary IP address. | long |
+| netbox.device.primary_ip.name | The name of the primary IP address. | keyword |
+| netbox.device.primary_ip.url | The API URL for the primary IP address. | keyword |
+| netbox.device.primary_ip4.address | The primary IPv4 address. | ip |
+| netbox.device.primary_ip4.description | The description of the primary IPv4 address. | text |
+| netbox.device.primary_ip4.display | The display name of the primary IPv4 address. | keyword |
+| netbox.device.primary_ip4.family.label | The IP family label (IPv4). | keyword |
+| netbox.device.primary_ip4.family.value | The IP family value (4 for IPv4). | long |
+| netbox.device.primary_ip4.id | The unique identifier of the primary IPv4 address. | long |
+| netbox.device.primary_ip4.name | The name of the primary IPv4 address. | keyword |
+| netbox.device.primary_ip4.url | The API URL for the primary IPv4 address. | keyword |
+| netbox.device.primary_ip6.address | The primary IPv6 address. | ip |
+| netbox.device.primary_ip6.description | The description of the primary IPv6 address. | text |
+| netbox.device.primary_ip6.display | The display name of the primary IPv6 address. | keyword |
+| netbox.device.primary_ip6.family.label | The IP family label (IPv6). | keyword |
+| netbox.device.primary_ip6.family.value | The IP family value (6 for IPv6). | long |
+| netbox.device.primary_ip6.id | The unique identifier of the primary IPv6 address. | long |
+| netbox.device.primary_ip6.name | The name of the primary IPv6 address. | keyword |
+| netbox.device.primary_ip6.url | The API URL for the primary IPv6 address. | keyword |
+| netbox.device.rack.description | The description of the rack. | text |
+| netbox.device.rack.display | The display name of the rack. | keyword |
+| netbox.device.rack.id | The unique identifier of the rack. | long |
+| netbox.device.rack.name | The name of the rack. | keyword |
+| netbox.device.rack.url | The API URL for the rack. | keyword |
+| netbox.device.rear_port_count | The number of rear ports on the device. | long |
+| netbox.device.role._depth | The depth level of the device role. | long |
+| netbox.device.role.description | The description of the device role. | text |
+| netbox.device.role.display | The display name of the device role. | keyword |
+| netbox.device.role.id | The unique identifier of the device role. | long |
+| netbox.device.role.name | The name of the device role. | keyword |
+| netbox.device.role.slug | The slug of the device role. | keyword |
+| netbox.device.role.url | The API URL for the device role. | keyword |
+| netbox.device.serial | The serial number of the device. | keyword |
+| netbox.device.site.description | The description of the site. | text |
+| netbox.device.site.display | The display name of the site. | keyword |
+| netbox.device.site.id | The unique identifier of the site. | long |
+| netbox.device.site.name | The name of the site. | keyword |
+| netbox.device.site.slug | The slug of the site. | keyword |
+| netbox.device.site.url | The API URL for the site. | keyword |
+| netbox.device.status.label | The status label of the device. | keyword |
+| netbox.device.status.value | The status value of the device. | keyword |
+| netbox.device.vc_position | The virtual chassis position of the device. | long |
+| netbox.device.vc_priority | The virtual chassis priority of the device. | long |
+| netbox.device.virtual_chassis.description | The description of the virtual chassis. | text |
+| netbox.device.virtual_chassis.display | The display name of the virtual chassis. | keyword |
+| netbox.device.virtual_chassis.id | The unique identifier of the virtual chassis. | long |
+| netbox.device.virtual_chassis.master.display | The display name of the master device. | keyword |
+| netbox.device.virtual_chassis.master.display_url | The web UI URL for the master device. | keyword |
+| netbox.device.virtual_chassis.master.id | The unique identifier of the master device. | long |
+| netbox.device.virtual_chassis.master.name | The name of the master device. | keyword |
+| netbox.device.virtual_chassis.master.url | The API URL for the master device. | keyword |
+| netbox.device.virtual_chassis.member_count | The number of members in the virtual chassis. | long |
+| netbox.device.virtual_chassis.name | The name of the virtual chassis. | keyword |
+| netbox.device.virtual_chassis.url | The API URL for the virtual chassis. | keyword |
+| netbox.display | The display name of the device. | keyword |
+| netbox.display_url | The web UI URL for the device. | keyword |
+| netbox.last_updated | The timestamp when the device was last updated. | date |
+| netbox.tags.color | The color code of the tag. | keyword |
+| netbox.tags.display | The display name of the tag. | keyword |
+| netbox.tags.display_url | The display URL for the tag. | keyword |
+| netbox.tags.id | The unique identifier of the tag. | long |
+| netbox.tags.name | The name of the tag. | keyword |
+| netbox.tags.slug | The slug of the tag. | keyword |
+| netbox.tags.url | The API URL for the tag. | keyword |
+| netbox.tenant.description | The description of the tenant. | text |
+| netbox.tenant.display | The display name of the tenant. | keyword |
+| netbox.tenant.id | The unique identifier of the tenant. | long |
+| netbox.tenant.name | The name of the tenant. | keyword |
+| netbox.tenant.slug | The slug of the tenant. | keyword |
+| netbox.tenant.url | The API URL for the tenant. | keyword |
+| netbox.url | The API URL for the device. | keyword |
+
+
+### IPs
+
+Collects IP addresses from the [IP Addresses API](https://demo.netbox.dev/api/schema/swagger-ui/#/ipam/ipam_ip_addresses_list).
+
+An example event for `ips` looks as following:
+
+```json
+{
+ "@timestamp": "2025-11-19T16:30:17.238Z",
+ "agent": {
+ "ephemeral_id": "aa94dc52-91c8-4549-a2d7-2d2c9ad0ff46",
+ "id": "edba1e8a-5a84-4b40-804b-9cb97eac5bd7",
+ "name": "elastic-agent-48422",
+ "type": "filebeat",
+ "version": "9.2.1"
+ },
+ "data_stream": {
+ "dataset": "netbox.ips",
+ "namespace": "82567",
+ "type": "logs"
+ },
+ "ecs": {
+ "version": "8.11.0"
+ },
+ "elastic_agent": {
+ "id": "edba1e8a-5a84-4b40-804b-9cb97eac5bd7",
+ "snapshot": false,
+ "version": "9.2.1"
+ },
+ "event": {
+ "agent_id_status": "verified",
+ "category": [
+ "configuration"
+ ],
+ "created": "2025-11-19T16:30:17.238Z",
+ "dataset": "netbox.ips",
+ "ingested": "2025-11-19T16:30:20Z",
+ "kind": "asset",
+ "original": "{\"address\":\"192.168.1.101/32\",\"assigned_object\":{\"_occupied\":false,\"cable\":null,\"description\":\"test-description\",\"device\":{\"description\":\"test-description\",\"display\":\"user-1-macbook-pro (tag-1234)\",\"id\":1,\"name\":\"user-1-macbook-pro\",\"url\":\"http://localhost:8000/api/dcim/devices/1/\"},\"display\":\"hello\",\"id\":2,\"name\":\"user-hello\",\"url\":\"http://localhost:8000/api/dcim/interfaces/2/\"},\"assigned_object_id\":2,\"assigned_object_type\":\"dcim.interface\",\"comments\":\"\",\"created\":\"2025-08-11T18:07:04.795476Z\",\"custom_fields\":{},\"description\":\"desc\",\"display\":\"192.168.1.101/32\",\"display_url\":\"http://localhost:8000/ipam/ip-addresses/2/\",\"dns_name\":\"hello.world\",\"family\":{\"label\":\"IPv4\",\"value\":4},\"id\":2,\"last_updated\":\"2025-08-11T18:07:04.795486Z\",\"nat_inside\":null,\"nat_outside\":[],\"role\":{\"label\":\"Secondary\",\"value\":\"secondary\"},\"status\":{\"label\":\"Active\",\"value\":\"active\"},\"tags\":[{\"color\":\"ff9800\",\"display\":\"elastic\",\"display_url\":\"http://localhost:8000/extras/tags/4/\",\"id\":4,\"name\":\"elastic\",\"slug\":\"elastic\",\"url\":\"http://localhost:8000/api/extras/tags/4/\"}],\"tenant\":{\"description\":\"first tenant\",\"display\":\"tenant-1\",\"id\":1,\"name\":\"tenant-1\",\"slug\":\"tenant-1\",\"url\":\"http://localhost:8000/api/tenancy/tenants/1/\"},\"url\":\"http://localhost:8000/api/ipam/ip-addresses/2/\",\"vrf\":{\"description\":\"asdf\",\"display\":\"test\",\"id\":1,\"name\":\"test\",\"rd\":null,\"url\":\"http://localhost:8000/api/ipam/vrfs/1/\"}}"
+ },
+ "input": {
+ "type": "httpjson"
+ },
+ "netbox": {
+ "created": "2025-08-11T18:07:04.795Z",
+ "display": "192.168.1.101/32",
+ "display_url": "http://localhost:8000/ipam/ip-addresses/2/",
+ "ip": {
+ "address": "192.168.1.101",
+ "assigned_object": {
+ "_occupied": false,
+ "description": "test-description",
+ "device": {
+ "description": "test-description",
+ "display": "user-1-macbook-pro (tag-1234)",
+ "id": 1,
+ "name": "user-1-macbook-pro",
+ "url": "http://localhost:8000/api/dcim/devices/1/"
+ },
+ "display": "hello",
+ "id": 2,
+ "name": "user-hello",
+ "url": "http://localhost:8000/api/dcim/interfaces/2/"
+ },
+ "assigned_object_id": 2,
+ "assigned_object_type": "dcim.interface",
+ "description": "desc",
+ "dns_name": "hello.world",
+ "family": {
+ "label": "IPv4",
+ "value": 4
+ },
+ "id": 2,
+ "role": {
+ "label": "Secondary",
+ "value": "secondary"
+ },
+ "status": {
+ "label": "Active",
+ "value": "active"
+ },
+ "vrf": {
+ "description": "asdf",
+ "display": "test",
+ "id": 1,
+ "name": "test",
+ "url": "http://localhost:8000/api/ipam/vrfs/1/"
+ }
+ },
+ "last_updated": "2025-08-11T18:07:04.795Z",
+ "tags": {
+ "color": [
+ "ff9800"
+ ],
+ "display": [
+ "elastic"
+ ],
+ "display_url": [
+ "http://localhost:8000/extras/tags/4/"
+ ],
+ "id": [
+ 4
+ ],
+ "name": [
+ "elastic"
+ ],
+ "slug": [
+ "elastic"
+ ],
+ "url": [
+ "http://localhost:8000/api/extras/tags/4/"
+ ]
+ },
+ "tenant": {
+ "description": "first tenant",
+ "display": "tenant-1",
+ "id": 1,
+ "name": "tenant-1",
+ "slug": "tenant-1",
+ "url": "http://localhost:8000/api/tenancy/tenants/1/"
+ },
+ "url": "http://localhost:8000/api/ipam/ip-addresses/2/"
+ },
+ "related": {
+ "ip": [
+ "192.168.1.101"
+ ]
+ },
+ "tags": [
+ "preserve_original_event",
+ "forwarded",
+ "netbox-ips"
+ ]
+}
+```
+
+**Exported fields**
+
+| Field | Description | Type |
+|---|---|---|
+| @timestamp | Event timestamp. | date |
+| data_stream.dataset | Data stream dataset. | constant_keyword |
+| data_stream.namespace | Data stream namespace. | constant_keyword |
+| data_stream.type | Data stream type. | constant_keyword |
+| input.type | Input type | keyword |
+| netbox.comments | User-provided comments for the IP address. | text |
+| netbox.created | The timestamp when the IP address was created. | date |
+| netbox.custom_fields | Custom fields configured for the IP address. | object |
+| netbox.display | The display name of the IP address. | keyword |
+| netbox.display_url | The web UI URL for the IP address. | keyword |
+| netbox.ip.address | The IP address in CIDR notation. | ip |
+| netbox.ip.assigned_object._occupied | Whether the interface is occupied. | boolean |
+| netbox.ip.assigned_object.cable | The cable connection information. | keyword |
+| netbox.ip.assigned_object.description | The description of the assigned object. | text |
+| netbox.ip.assigned_object.device.description | The description of the device. | text |
+| netbox.ip.assigned_object.device.display | The display name of the device. | keyword |
+| netbox.ip.assigned_object.device.id | The unique identifier of the device. | long |
+| netbox.ip.assigned_object.device.name | The name of the device. | keyword |
+| netbox.ip.assigned_object.device.url | The API URL for the device. | keyword |
+| netbox.ip.assigned_object.display | The display name of the assigned object. | keyword |
+| netbox.ip.assigned_object.id | The unique identifier of the assigned object. | long |
+| netbox.ip.assigned_object.name | The name of the assigned object (interface). | keyword |
+| netbox.ip.assigned_object.url | The API URL for the assigned object. | keyword |
+| netbox.ip.assigned_object.virtual_machine.description | The description of the virtual machine. | text |
+| netbox.ip.assigned_object.virtual_machine.display | The display name of the virtual machine. | keyword |
+| netbox.ip.assigned_object.virtual_machine.id | The unique identifier of the virtual machine. | long |
+| netbox.ip.assigned_object.virtual_machine.name | The name of the virtual machine. | keyword |
+| netbox.ip.assigned_object.virtual_machine.url | The API URL for the virtual machine. | keyword |
+| netbox.ip.assigned_object_id | The unique identifier of the assigned object. | long |
+| netbox.ip.assigned_object_type | The type of object this IP address is assigned to. | keyword |
+| netbox.ip.description | The description of the IP address. | text |
+| netbox.ip.dns_name | The DNS name associated with the IP address. | keyword |
+| netbox.ip.family.label | The IP family label (IPv4 or IPv6). | keyword |
+| netbox.ip.family.value | The IP family value (4 for IPv4, 6 for IPv6). | long |
+| netbox.ip.id | The unique numeric identifier for the IP address. | long |
+| netbox.ip.nat_inside.address | | ip |
+| netbox.ip.nat_inside.display | | keyword |
+| netbox.ip.nat_inside.display_url | | keyword |
+| netbox.ip.nat_inside.family | | long |
+| netbox.ip.nat_inside.id | | long |
+| netbox.ip.nat_inside.url | | keyword |
+| netbox.ip.nat_outside.address | The NAT outside IP address. | ip |
+| netbox.ip.nat_outside.display | The display name of the NAT outside IP address. | keyword |
+| netbox.ip.nat_outside.display_url | The web UI URL for the NAT outside IP address. | keyword |
+| netbox.ip.nat_outside.family | The IP family value (4 for IPv4, 6 for IPv6). | long |
+| netbox.ip.nat_outside.id | The unique identifier of the NAT outside IP address. | long |
+| netbox.ip.nat_outside.url | The API URL for the NAT outside IP address. | keyword |
+| netbox.ip.role.label | The role label of the IP address. | keyword |
+| netbox.ip.role.value | The role value of the IP address. | keyword |
+| netbox.ip.status.label | The status label of the IP address. | keyword |
+| netbox.ip.status.value | The status value of the IP address. | keyword |
+| netbox.ip.vrf.description | The description of the VRF. | text |
+| netbox.ip.vrf.display | The display name of the VRF. | keyword |
+| netbox.ip.vrf.id | The unique identifier of the VRF. | long |
+| netbox.ip.vrf.name | The name of the VRF. | keyword |
+| netbox.ip.vrf.rd | The route distinguisher of the VRF. | keyword |
+| netbox.ip.vrf.url | The API URL for the VRF. | keyword |
+| netbox.last_updated | The timestamp when the IP address was last updated. | date |
+| netbox.tags.color | The color code of the tag. | keyword |
+| netbox.tags.display | The display name of the tag. | keyword |
+| netbox.tags.display_url | The display URL for the tag. | keyword |
+| netbox.tags.id | The unique identifier of the tag. | long |
+| netbox.tags.name | The name of the tag. | keyword |
+| netbox.tags.slug | The slug of the tag. | keyword |
+| netbox.tags.url | The API URL for the tag. | keyword |
+| netbox.tenant.description | The description of the tenant. | text |
+| netbox.tenant.display | The display name of the tenant. | keyword |
+| netbox.tenant.id | The unique identifier of the tenant. | long |
+| netbox.tenant.name | The name of the tenant. | keyword |
+| netbox.tenant.slug | The slug of the tenant. | keyword |
+| netbox.tenant.url | The API URL for the tenant. | keyword |
+| netbox.url | The API URL for the IP address. | keyword |
+
diff --git a/packages/netbox/img/devices-dashboard-overview.png b/packages/netbox/img/devices-dashboard-overview.png
new file mode 100644
index 00000000000..f971e2c0b37
Binary files /dev/null and b/packages/netbox/img/devices-dashboard-overview.png differ
diff --git a/packages/netbox/img/ips-dashboard-overview.png b/packages/netbox/img/ips-dashboard-overview.png
new file mode 100644
index 00000000000..6e2e417f58d
Binary files /dev/null and b/packages/netbox/img/ips-dashboard-overview.png differ
diff --git a/packages/netbox/img/netbox-logo.svg b/packages/netbox/img/netbox-logo.svg
new file mode 100644
index 00000000000..61b9b5aabbd
--- /dev/null
+++ b/packages/netbox/img/netbox-logo.svg
@@ -0,0 +1,20 @@
+
diff --git a/packages/netbox/kibana/dashboard/netbox-465940a7-82b5-4a7d-9646-75882af25771.json b/packages/netbox/kibana/dashboard/netbox-465940a7-82b5-4a7d-9646-75882af25771.json
new file mode 100644
index 00000000000..8d13b4b26bc
--- /dev/null
+++ b/packages/netbox/kibana/dashboard/netbox-465940a7-82b5-4a7d-9646-75882af25771.json
@@ -0,0 +1,1650 @@
+{
+ "attributes": {
+ "controlGroupInput": {
+ "chainingSystem": "HIERARCHICAL",
+ "controlStyle": "oneLine",
+ "ignoreParentSettingsJSON": {
+ "ignoreFilters": false,
+ "ignoreQuery": false,
+ "ignoreTimerange": false,
+ "ignoreValidations": false
+ },
+ "panelsJSON": {
+ "010bd9ed-468c-4816-8316-315c70ac94fa": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "netbox.device.virtual_chassis.name",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ }
+ },
+ "grow": true,
+ "order": 3,
+ "type": "optionsListControl",
+ "width": "medium"
+ },
+ "657d77f2-77a5-4f1b-af21-78365de55e0a": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "netbox.tenant.name",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ }
+ },
+ "grow": true,
+ "order": 1,
+ "type": "optionsListControl",
+ "width": "medium"
+ },
+ "8420c75b-0ff4-4c43-87eb-25a0fdafe4e5": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "netbox.device.cluster.name",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ }
+ },
+ "grow": true,
+ "order": 2,
+ "type": "optionsListControl",
+ "width": "medium"
+ },
+ "9aeac902-6a2b-4502-be29-a4856df30aff": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "netbox.tags.name",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ }
+ },
+ "grow": true,
+ "order": 0,
+ "type": "optionsListControl",
+ "width": "medium"
+ }
+ },
+ "showApplySelections": false
+ },
+ "description": "",
+ "kibanaSavedObjectMeta": {
+ "searchSourceJSON": {
+ "filter": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ }
+ }
+ },
+ "optionsJSON": {
+ "hidePanelTitles": false,
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "useMargins": true
+ },
+ "panelsJSON": [
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-7e90126b-f09a-49e7-bae6-e3b174322c2c",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "7e90126b-f09a-49e7-bae6-e3b174322c2c": {
+ "columnOrder": [
+ "441d49d4-1692-4698-8248-039b1f0e7158",
+ "9be7e786-df6c-4e3c-b50a-b042f9ea9679",
+ "fa3f7e5f-cc71-47b5-9ad0-2d0598314af6",
+ "049f344e-b6e2-4903-9176-b03675996d62"
+ ],
+ "columns": {
+ "049f344e-b6e2-4903-9176-b03675996d62": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Unique count of netbox.device.name",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.device.name"
+ },
+ "441d49d4-1692-4698-8248-039b1f0e7158": {
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top 5 values of netbox.device.site.name",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "049f344e-b6e2-4903-9176-b03675996d62",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 5
+ },
+ "sourceField": "netbox.device.site.name"
+ },
+ "9be7e786-df6c-4e3c-b50a-b042f9ea9679": {
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top 3 values of netbox.device.location.name",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "049f344e-b6e2-4903-9176-b03675996d62",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 3
+ },
+ "sourceField": "netbox.device.location.name"
+ },
+ "fa3f7e5f-cc71-47b5-9ad0-2d0598314af6": {
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top 3 values of netbox.device.rack.name",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "049f344e-b6e2-4903-9176-b03675996d62",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 3
+ },
+ "sourceField": "netbox.device.rack.name"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "visualization": {
+ "layers": [
+ {
+ "categoryDisplay": "default",
+ "colorMapping": {
+ "assignments": [],
+ "colorMode": {
+ "type": "categorical"
+ },
+ "paletteId": "default",
+ "specialAssignments": [
+ {
+ "color": {
+ "type": "loop"
+ },
+ "rules": [
+ {
+ "type": "other"
+ }
+ ],
+ "touched": false
+ }
+ ]
+ },
+ "emptySizeRatio": 0.54,
+ "layerId": "7e90126b-f09a-49e7-bae6-e3b174322c2c",
+ "layerType": "data",
+ "legendDisplay": "default",
+ "metrics": [
+ "049f344e-b6e2-4903-9176-b03675996d62"
+ ],
+ "nestedLegend": false,
+ "numberDisplay": "percent",
+ "primaryGroups": [
+ "441d49d4-1692-4698-8248-039b1f0e7158",
+ "9be7e786-df6c-4e3c-b50a-b042f9ea9679",
+ "fa3f7e5f-cc71-47b5-9ad0-2d0598314af6"
+ ]
+ }
+ ],
+ "shape": "donut"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsPie"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "title": "Device Location Hierarchy"
+ },
+ "gridData": {
+ "h": 17,
+ "i": "cd441bf3-635a-4678-9b11-f683d9f0d8f1",
+ "w": 11,
+ "x": 28,
+ "y": 0
+ },
+ "panelIndex": "cd441bf3-635a-4678-9b11-f683d9f0d8f1",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-13a4afba-dce2-4f1c-836e-cd7fc6d0484d",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "13a4afba-dce2-4f1c-836e-cd7fc6d0484d": {
+ "columnOrder": [
+ "17bf155c-4cec-4d23-8c16-b10cfba825c9",
+ "f53b619c-320f-4634-aaaa-84f36398f5b3"
+ ],
+ "columns": {
+ "17bf155c-4cec-4d23-8c16-b10cfba825c9": {
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top 10 values of netbox.device.device_type.manufacturer.name",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "f53b619c-320f-4634-aaaa-84f36398f5b3",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "netbox.device.device_type.manufacturer.name"
+ },
+ "f53b619c-320f-4634-aaaa-84f36398f5b3": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Unique count of netbox.device.name",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.device.name"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "visualization": {
+ "layers": [
+ {
+ "categoryDisplay": "default",
+ "colorMapping": {
+ "assignments": [],
+ "colorMode": {
+ "type": "categorical"
+ },
+ "paletteId": "default",
+ "specialAssignments": [
+ {
+ "color": {
+ "type": "loop"
+ },
+ "rules": [
+ {
+ "type": "other"
+ }
+ ],
+ "touched": false
+ }
+ ]
+ },
+ "layerId": "13a4afba-dce2-4f1c-836e-cd7fc6d0484d",
+ "layerType": "data",
+ "legendDisplay": "default",
+ "metrics": [
+ "f53b619c-320f-4634-aaaa-84f36398f5b3"
+ ],
+ "nestedLegend": false,
+ "numberDisplay": "percent",
+ "primaryGroups": [
+ "17bf155c-4cec-4d23-8c16-b10cfba825c9"
+ ]
+ }
+ ],
+ "shape": "pie"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsPie"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "title": "Top 10 Device Manufacturers"
+ },
+ "gridData": {
+ "h": 17,
+ "i": "61518058-1374-4742-bbd3-f8ae70fa2e10",
+ "w": 9,
+ "x": 39,
+ "y": 0
+ },
+ "panelIndex": "61518058-1374-4742-bbd3-f8ae70fa2e10",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-59667b50-d87e-438b-923c-2f178600c414",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "59667b50-d87e-438b-923c-2f178600c414": {
+ "columnOrder": [
+ "e162e2e9-86af-484f-9d25-8e4da638cab2",
+ "2cb7bb09-760e-42b8-9865-fb5fd0f3d20d"
+ ],
+ "columns": {
+ "2cb7bb09-760e-42b8-9865-fb5fd0f3d20d": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Unique count of netbox.device.name",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.device.name"
+ },
+ "e162e2e9-86af-484f-9d25-8e4da638cab2": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Model Names",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "2cb7bb09-760e-42b8-9865-fb5fd0f3d20d",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "netbox.device.device_type.model"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "visualization": {
+ "axisTitlesVisibilitySettings": {
+ "x": true,
+ "yLeft": true,
+ "yRight": true
+ },
+ "fittingFunction": "Linear",
+ "gridlinesVisibilitySettings": {
+ "x": true,
+ "yLeft": true,
+ "yRight": true
+ },
+ "labelsOrientation": {
+ "x": 0,
+ "yLeft": 0,
+ "yRight": 0
+ },
+ "layers": [
+ {
+ "accessors": [
+ "2cb7bb09-760e-42b8-9865-fb5fd0f3d20d"
+ ],
+ "colorMapping": {
+ "assignments": [],
+ "colorMode": {
+ "type": "categorical"
+ },
+ "paletteId": "default",
+ "specialAssignments": [
+ {
+ "color": {
+ "type": "loop"
+ },
+ "rules": [
+ {
+ "type": "other"
+ }
+ ],
+ "touched": false
+ }
+ ]
+ },
+ "layerId": "59667b50-d87e-438b-923c-2f178600c414",
+ "layerType": "data",
+ "position": "top",
+ "seriesType": "bar_stacked",
+ "showGridlines": false,
+ "xAccessor": "e162e2e9-86af-484f-9d25-8e4da638cab2"
+ }
+ ],
+ "legend": {
+ "isVisible": true,
+ "position": "right"
+ },
+ "preferredSeriesType": "bar_stacked",
+ "tickLabelsVisibilitySettings": {
+ "x": true,
+ "yLeft": true,
+ "yRight": true
+ },
+ "valueLabels": "hide"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsXY"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "title": "Top 10 Device Models"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "91c4d0b9-ebc5-4dd7-886b-fe8ee02a6ff1",
+ "w": 17,
+ "x": 0,
+ "y": 17
+ },
+ "panelIndex": "91c4d0b9-ebc5-4dd7-886b-fe8ee02a6ff1",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-671b7eda-aaa8-4f9a-b72e-19f04ce85d2d",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "671b7eda-aaa8-4f9a-b72e-19f04ce85d2d": {
+ "columnOrder": [
+ "6245c2fc-db26-46ad-9250-2dda0ca04f20",
+ "b823081c-bf29-416a-852e-fc2cd4dd205b"
+ ],
+ "columns": {
+ "6245c2fc-db26-46ad-9250-2dda0ca04f20": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Device Roles",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "b823081c-bf29-416a-852e-fc2cd4dd205b",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "netbox.device.role.name"
+ },
+ "b823081c-bf29-416a-852e-fc2cd4dd205b": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Count of devices",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.device.name"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "visualization": {
+ "axisTitlesVisibilitySettings": {
+ "x": true,
+ "yLeft": true,
+ "yRight": true
+ },
+ "fittingFunction": "Linear",
+ "gridlinesVisibilitySettings": {
+ "x": true,
+ "yLeft": true,
+ "yRight": true
+ },
+ "labelsOrientation": {
+ "x": 0,
+ "yLeft": 0,
+ "yRight": 0
+ },
+ "layers": [
+ {
+ "accessors": [
+ "b823081c-bf29-416a-852e-fc2cd4dd205b"
+ ],
+ "colorMapping": {
+ "assignments": [],
+ "colorMode": {
+ "type": "categorical"
+ },
+ "paletteId": "default",
+ "specialAssignments": [
+ {
+ "color": {
+ "type": "loop"
+ },
+ "rules": [
+ {
+ "type": "other"
+ }
+ ],
+ "touched": false
+ }
+ ]
+ },
+ "layerId": "671b7eda-aaa8-4f9a-b72e-19f04ce85d2d",
+ "layerType": "data",
+ "position": "top",
+ "seriesType": "bar_stacked",
+ "showGridlines": false,
+ "xAccessor": "6245c2fc-db26-46ad-9250-2dda0ca04f20"
+ }
+ ],
+ "legend": {
+ "isVisible": true,
+ "position": "right"
+ },
+ "preferredSeriesType": "bar_stacked",
+ "tickLabelsVisibilitySettings": {
+ "x": true,
+ "yLeft": true,
+ "yRight": true
+ },
+ "valueLabels": "hide"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsXY"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "title": "Top 10 Device Roles"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "66216c8e-caca-4934-8211-c23b8928fadf",
+ "w": 16,
+ "x": 17,
+ "y": 17
+ },
+ "panelIndex": "66216c8e-caca-4934-8211-c23b8928fadf",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-46519bb3-a69d-40ad-a3db-b6d5543e8c35",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "46519bb3-a69d-40ad-a3db-b6d5543e8c35": {
+ "columnOrder": [
+ "014831e0-84ec-47de-83de-888509118516",
+ "200f7e3d-182e-4648-8f62-59544bc3634b"
+ ],
+ "columns": {
+ "014831e0-84ec-47de-83de-888509118516": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Device Platforms",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "200f7e3d-182e-4648-8f62-59544bc3634b",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "netbox.device.platform.name"
+ },
+ "200f7e3d-182e-4648-8f62-59544bc3634b": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Unique count of netbox.device.name",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.device.name"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "visualization": {
+ "axisTitlesVisibilitySettings": {
+ "x": true,
+ "yLeft": true,
+ "yRight": true
+ },
+ "fittingFunction": "Linear",
+ "gridlinesVisibilitySettings": {
+ "x": true,
+ "yLeft": true,
+ "yRight": true
+ },
+ "labelsOrientation": {
+ "x": 0,
+ "yLeft": 0,
+ "yRight": 0
+ },
+ "layers": [
+ {
+ "accessors": [
+ "200f7e3d-182e-4648-8f62-59544bc3634b"
+ ],
+ "colorMapping": {
+ "assignments": [],
+ "colorMode": {
+ "type": "categorical"
+ },
+ "paletteId": "default",
+ "specialAssignments": [
+ {
+ "color": {
+ "type": "loop"
+ },
+ "rules": [
+ {
+ "type": "other"
+ }
+ ],
+ "touched": false
+ }
+ ]
+ },
+ "layerId": "46519bb3-a69d-40ad-a3db-b6d5543e8c35",
+ "layerType": "data",
+ "position": "top",
+ "seriesType": "bar_stacked",
+ "showGridlines": false,
+ "xAccessor": "014831e0-84ec-47de-83de-888509118516"
+ }
+ ],
+ "legend": {
+ "isVisible": true,
+ "position": "right"
+ },
+ "preferredSeriesType": "bar_stacked",
+ "tickLabelsVisibilitySettings": {
+ "x": true,
+ "yLeft": true,
+ "yRight": true
+ },
+ "valueLabels": "hide"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsXY"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "title": "Top 10 Device Platforms"
+ },
+ "gridData": {
+ "h": 15,
+ "i": "92dcae95-3782-4afb-9d41-be65b0ffe9d4",
+ "w": 15,
+ "x": 33,
+ "y": 17
+ },
+ "panelIndex": "92dcae95-3782-4afb-9d41-be65b0ffe9d4",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-52d4f20d-8b1d-49af-89b4-b42230a056b1",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "52d4f20d-8b1d-49af-89b4-b42230a056b1": {
+ "columnOrder": [
+ "e225b2b0-1265-48db-a1c2-fbd251aa9a8f",
+ "268bfa63-7047-4062-8357-cec24104e2b5",
+ "512d6ff5-afce-4897-9ed3-a03e725391a7",
+ "d3debdb6-2e3a-4231-a00c-2d6f732c7358",
+ "57684a74-420b-461c-bd32-2250047263d4",
+ "be51ab01-f786-4b87-b198-6caac533bc4d"
+ ],
+ "columns": {
+ "268bfa63-7047-4062-8357-cec24104e2b5": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Name",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "be51ab01-f786-4b87-b198-6caac533bc4d",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "netbox.device.name"
+ },
+ "512d6ff5-afce-4897-9ed3-a03e725391a7": {
+ "customLabel": true,
+ "dataType": "ip",
+ "isBucketed": true,
+ "label": "Primary IP Address",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "be51ab01-f786-4b87-b198-6caac533bc4d",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "netbox.device.primary_ip.address"
+ },
+ "57684a74-420b-461c-bd32-2250047263d4": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Site",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "be51ab01-f786-4b87-b198-6caac533bc4d",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "netbox.device.site.name"
+ },
+ "be51ab01-f786-4b87-b198-6caac533bc4d": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Device Count",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.device.name"
+ },
+ "d3debdb6-2e3a-4231-a00c-2d6f732c7358": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Location",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "be51ab01-f786-4b87-b198-6caac533bc4d",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "netbox.device.location.name"
+ },
+ "e225b2b0-1265-48db-a1c2-fbd251aa9a8f": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "URL",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "be51ab01-f786-4b87-b198-6caac533bc4d",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "netbox.display_url"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "visualization": {
+ "columns": [
+ {
+ "columnId": "e225b2b0-1265-48db-a1c2-fbd251aa9a8f"
+ },
+ {
+ "columnId": "be51ab01-f786-4b87-b198-6caac533bc4d",
+ "hidden": true,
+ "summaryRow": "sum"
+ },
+ {
+ "columnId": "268bfa63-7047-4062-8357-cec24104e2b5",
+ "isMetric": false,
+ "isTransposed": false
+ },
+ {
+ "columnId": "512d6ff5-afce-4897-9ed3-a03e725391a7",
+ "isMetric": false,
+ "isTransposed": false
+ },
+ {
+ "columnId": "d3debdb6-2e3a-4231-a00c-2d6f732c7358",
+ "isMetric": false,
+ "isTransposed": false
+ },
+ {
+ "columnId": "57684a74-420b-461c-bd32-2250047263d4",
+ "isMetric": false,
+ "isTransposed": false
+ }
+ ],
+ "layerId": "52d4f20d-8b1d-49af-89b4-b42230a056b1",
+ "layerType": "data",
+ "paging": {
+ "enabled": true,
+ "size": 10
+ }
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsDatatable"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": [
+ {
+ "action": {
+ "config": {
+ "encodeUrl": true,
+ "openInNewTab": true,
+ "url": {
+ "template": "{{event.values.[0]}}"
+ }
+ },
+ "factoryId": "URL_DRILLDOWN",
+ "name": "See in Netbox"
+ },
+ "eventId": "4ebdb3fe-140a-4341-9158-966e8020be39",
+ "triggers": [
+ "ROW_CLICK_TRIGGER"
+ ]
+ }
+ ]
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false
+ },
+ "gridData": {
+ "h": 15,
+ "i": "b9c29095-261f-4d84-a961-954c2dd741ec",
+ "w": 48,
+ "x": 0,
+ "y": 32
+ },
+ "panelIndex": "b9c29095-261f-4d84-a961-954c2dd741ec",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3cdbde48-3b81-4b60-b7fd-33f7ec68cc7e",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3cdbde48-3b81-4b60-b7fd-33f7ec68cc7e": {
+ "columnOrder": [
+ "865ef4bf-4127-47d5-9d1c-816b40c445f3"
+ ],
+ "columns": {
+ "865ef4bf-4127-47d5-9d1c-816b40c445f3": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Number of Devices",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.device.name"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "visualization": {
+ "color": "#A6EDEA",
+ "layerId": "3cdbde48-3b81-4b60-b7fd-33f7ec68cc7e",
+ "layerType": "data",
+ "metricAccessor": "865ef4bf-4127-47d5-9d1c-816b40c445f3",
+ "secondaryTrend": {
+ "type": "none"
+ }
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsMetric"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false
+ },
+ "gridData": {
+ "h": 17,
+ "i": "b6acd143-1715-4083-9322-f453b7804134",
+ "w": 6,
+ "x": 12,
+ "y": 0
+ },
+ "panelIndex": "b6acd143-1715-4083-9322-f453b7804134",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "savedVis": {
+ "data": {
+ "aggs": [],
+ "searchSource": {
+ "filter": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ }
+ }
+ },
+ "description": "",
+ "params": {
+ "fontSize": 12,
+ "markdown": "[Logs Netbox] Devices\n\n**Netbox** \n**[Devices](#/dashboard/netbox-465940a7-82b5-4a7d-9646-75882af25771)** \n[IP Addresses](#/dashboard/netbox-51662583-0923-4203-b806-9f41ece4df26)\n\n**Devices**\n\nThis dashboard gives an overview of the current devices in Netbox.\n",
+ "openLinksInNewTab": false
+ },
+ "title": "",
+ "type": "markdown",
+ "uiState": {}
+ }
+ },
+ "gridData": {
+ "h": 17,
+ "i": "4ae08eb5-0fa3-446f-b6c5-885f72fba8d5",
+ "w": 12,
+ "x": 0,
+ "y": 0
+ },
+ "panelIndex": "4ae08eb5-0fa3-446f-b6c5-885f72fba8d5",
+ "type": "visualization"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-caba48e6-858c-4077-a12e-030e9e8b581a",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "caba48e6-858c-4077-a12e-030e9e8b581a": {
+ "columnOrder": [
+ "1326f8c3-b44b-47c4-bb10-15d3845f1347",
+ "22e045c5-f8a0-433f-87b1-4c1d2b5411c7"
+ ],
+ "columns": {
+ "1326f8c3-b44b-47c4-bb10-15d3845f1347": {
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top 7 values of netbox.device.status.value",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "22e045c5-f8a0-433f-87b1-4c1d2b5411c7",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": false,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 7
+ },
+ "sourceField": "netbox.device.status.value"
+ },
+ "22e045c5-f8a0-433f-87b1-4c1d2b5411c7": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Unique count of netbox.device.name",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.device.name"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.devices\" "
+ },
+ "visualization": {
+ "layers": [
+ {
+ "categoryDisplay": "default",
+ "colorMapping": {
+ "assignments": [
+ {
+ "color": {
+ "colorIndex": 0,
+ "paletteId": "default",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "active"
+ }
+ ],
+ "touched": false
+ },
+ {
+ "color": {
+ "colorCode": "#f93f3f",
+ "type": "colorCode"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "failed"
+ }
+ ],
+ "touched": true
+ },
+ {
+ "color": {
+ "colorIndex": 2,
+ "paletteId": "default",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "planned"
+ }
+ ],
+ "touched": true
+ },
+ {
+ "color": {
+ "colorIndex": 3,
+ "paletteId": "neutral",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "decommissioning"
+ }
+ ],
+ "touched": true
+ },
+ {
+ "color": {
+ "colorIndex": 1,
+ "paletteId": "neutral",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "inventory"
+ }
+ ],
+ "touched": true
+ },
+ {
+ "color": {
+ "colorIndex": 6,
+ "paletteId": "default",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "offline"
+ }
+ ],
+ "touched": true
+ },
+ {
+ "color": {
+ "colorIndex": 8,
+ "paletteId": "default",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "staged"
+ }
+ ],
+ "touched": true
+ }
+ ],
+ "colorMode": {
+ "type": "categorical"
+ },
+ "paletteId": "default",
+ "specialAssignments": [
+ {
+ "color": {
+ "colorIndex": 1,
+ "paletteId": "neutral",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "other"
+ }
+ ],
+ "touched": true
+ }
+ ]
+ },
+ "layerId": "caba48e6-858c-4077-a12e-030e9e8b581a",
+ "layerType": "data",
+ "legendDisplay": "default",
+ "metrics": [
+ "22e045c5-f8a0-433f-87b1-4c1d2b5411c7"
+ ],
+ "nestedLegend": false,
+ "numberDisplay": "percent",
+ "primaryGroups": [
+ "1326f8c3-b44b-47c4-bb10-15d3845f1347"
+ ]
+ }
+ ],
+ "shape": "pie"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsPie"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "title": "Device Status Overview"
+ },
+ "gridData": {
+ "h": 17,
+ "i": "a12bdfaf-74e5-4857-b4b9-46698730e359",
+ "w": 10,
+ "x": 18,
+ "y": 0
+ },
+ "panelIndex": "a12bdfaf-74e5-4857-b4b9-46698730e359",
+ "type": "lens"
+ }
+ ],
+ "timeRestore": false,
+ "title": "[Logs Netbox] Devices",
+ "version": 3
+ },
+ "coreMigrationVersion": "8.8.0",
+ "created_at": "2025-08-15T14:17:06.790Z",
+ "created_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
+ "id": "netbox-465940a7-82b5-4a7d-9646-75882af25771",
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "cd441bf3-635a-4678-9b11-f683d9f0d8f1:indexpattern-datasource-layer-7e90126b-f09a-49e7-bae6-e3b174322c2c",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "61518058-1374-4742-bbd3-f8ae70fa2e10:indexpattern-datasource-layer-13a4afba-dce2-4f1c-836e-cd7fc6d0484d",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "91c4d0b9-ebc5-4dd7-886b-fe8ee02a6ff1:indexpattern-datasource-layer-59667b50-d87e-438b-923c-2f178600c414",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "66216c8e-caca-4934-8211-c23b8928fadf:indexpattern-datasource-layer-671b7eda-aaa8-4f9a-b72e-19f04ce85d2d",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "92dcae95-3782-4afb-9d41-be65b0ffe9d4:indexpattern-datasource-layer-46519bb3-a69d-40ad-a3db-b6d5543e8c35",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "b9c29095-261f-4d84-a961-954c2dd741ec:indexpattern-datasource-layer-52d4f20d-8b1d-49af-89b4-b42230a056b1",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "b6acd143-1715-4083-9322-f453b7804134:indexpattern-datasource-layer-3cdbde48-3b81-4b60-b7fd-33f7ec68cc7e",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "a12bdfaf-74e5-4857-b4b9-46698730e359:indexpattern-datasource-layer-caba48e6-858c-4077-a12e-030e9e8b581a",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_9aeac902-6a2b-4502-be29-a4856df30aff:optionsListDataView",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_657d77f2-77a5-4f1b-af21-78365de55e0a:optionsListDataView",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_8420c75b-0ff4-4c43-87eb-25a0fdafe4e5:optionsListDataView",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_010bd9ed-468c-4816-8316-315c70ac94fa:optionsListDataView",
+ "type": "index-pattern"
+ }
+ ],
+ "type": "dashboard",
+ "typeMigrationVersion": "10.3.0",
+ "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
+}
diff --git a/packages/netbox/kibana/dashboard/netbox-51662583-0923-4203-b806-9f41ece4df26.json b/packages/netbox/kibana/dashboard/netbox-51662583-0923-4203-b806-9f41ece4df26.json
new file mode 100644
index 00000000000..33174ee77a9
--- /dev/null
+++ b/packages/netbox/kibana/dashboard/netbox-51662583-0923-4203-b806-9f41ece4df26.json
@@ -0,0 +1,1160 @@
+{
+ "attributes": {
+ "controlGroupInput": {
+ "chainingSystem": "HIERARCHICAL",
+ "controlStyle": "oneLine",
+ "ignoreParentSettingsJSON": {
+ "ignoreFilters": false,
+ "ignoreQuery": false,
+ "ignoreTimerange": false,
+ "ignoreValidations": false
+ },
+ "panelsJSON": {
+ "4a7f54fb-0199-4bca-a369-b75ef652d114": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "netbox.ip.nat_outside.address",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ }
+ },
+ "grow": true,
+ "order": 3,
+ "type": "optionsListControl",
+ "width": "medium"
+ },
+ "657d77f2-77a5-4f1b-af21-78365de55e0a": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "netbox.tenant.name",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ }
+ },
+ "grow": true,
+ "order": 1,
+ "type": "optionsListControl",
+ "width": "medium"
+ },
+ "9aeac902-6a2b-4502-be29-a4856df30aff": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "netbox.tags.name",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ }
+ },
+ "grow": true,
+ "order": 0,
+ "type": "optionsListControl",
+ "width": "medium"
+ },
+ "cbcb39f4-634d-47f5-bd22-899abd192664": {
+ "explicitInput": {
+ "dataViewId": "logs-*",
+ "exclude": false,
+ "existsSelected": false,
+ "fieldName": "netbox.ip.vrf.name",
+ "searchTechnique": "prefix",
+ "selectedOptions": [],
+ "sort": {
+ "by": "_count",
+ "direction": "desc"
+ }
+ },
+ "grow": true,
+ "order": 2,
+ "type": "optionsListControl",
+ "width": "medium"
+ }
+ },
+ "showApplySelections": false
+ },
+ "description": "",
+ "kibanaSavedObjectMeta": {
+ "searchSourceJSON": {
+ "filter": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ }
+ }
+ },
+ "optionsJSON": {
+ "hidePanelTitles": false,
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "useMargins": true
+ },
+ "panelsJSON": [
+ {
+ "embeddableConfig": {
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "savedVis": {
+ "data": {
+ "aggs": [],
+ "searchSource": {
+ "filter": [],
+ "query": {
+ "language": "kuery",
+ "query": ""
+ }
+ }
+ },
+ "description": "",
+ "params": {
+ "fontSize": 12,
+ "markdown": "[Logs Netbox] IP Addresses\n\n**Netbox** \n[Devices](#/dashboard/netbox-465940a7-82b5-4a7d-9646-75882af25771) \n**[IP Addresses](#/dashboard/netbox-51662583-0923-4203-b806-9f41ece4df26)**\n\n**IP Addresses**\n\nThis dashboard gives an overview of the current ip addresses in NetBox.\n\n",
+ "openLinksInNewTab": false
+ },
+ "title": "",
+ "type": "markdown",
+ "uiState": {}
+ }
+ },
+ "gridData": {
+ "h": 17,
+ "i": "e281e2c4-97b9-4514-8d62-6be9f2f3a5c9",
+ "w": 11,
+ "x": 0,
+ "y": 0
+ },
+ "panelIndex": "e281e2c4-97b9-4514-8d62-6be9f2f3a5c9",
+ "type": "visualization"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-3cdbde48-3b81-4b60-b7fd-33f7ec68cc7e",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "3cdbde48-3b81-4b60-b7fd-33f7ec68cc7e": {
+ "columnOrder": [
+ "865ef4bf-4127-47d5-9d1c-816b40c445f3"
+ ],
+ "columns": {
+ "865ef4bf-4127-47d5-9d1c-816b40c445f3": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Number of IP Addresses",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.ip.address"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "visualization": {
+ "color": "#A6EDEA",
+ "layerId": "3cdbde48-3b81-4b60-b7fd-33f7ec68cc7e",
+ "layerType": "data",
+ "metricAccessor": "865ef4bf-4127-47d5-9d1c-816b40c445f3",
+ "secondaryTrend": {
+ "type": "none"
+ }
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsMetric"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false
+ },
+ "gridData": {
+ "h": 17,
+ "i": "3562aee3-f7c2-4b5c-9c21-c9f23cf7953e",
+ "w": 7,
+ "x": 11,
+ "y": 0
+ },
+ "panelIndex": "3562aee3-f7c2-4b5c-9c21-c9f23cf7953e",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-52d4f20d-8b1d-49af-89b4-b42230a056b1",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "52d4f20d-8b1d-49af-89b4-b42230a056b1": {
+ "columnOrder": [
+ "e225b2b0-1265-48db-a1c2-fbd251aa9a8f",
+ "a181d11d-1687-4070-9f1b-d6bc8dbca58e",
+ "5cc286fc-7be1-4ebb-86ab-0fad7366bd77",
+ "564cd5d2-cf08-424f-8e31-338441558078"
+ ],
+ "columns": {
+ "564cd5d2-cf08-424f-8e31-338441558078": {
+ "customLabel": true,
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "IP Count",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.ip.address"
+ },
+ "5cc286fc-7be1-4ebb-86ab-0fad7366bd77": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "DNS Name",
+ "operationType": "terms",
+ "params": {
+ "accuracyMode": false,
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": true,
+ "orderBy": {
+ "columnId": "564cd5d2-cf08-424f-8e31-338441558078",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "secondaryFields": [],
+ "size": 3
+ },
+ "sourceField": "netbox.ip.dns_name"
+ },
+ "a181d11d-1687-4070-9f1b-d6bc8dbca58e": {
+ "customLabel": true,
+ "dataType": "ip",
+ "isBucketed": true,
+ "label": "Address",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "564cd5d2-cf08-424f-8e31-338441558078",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 10
+ },
+ "sourceField": "netbox.ip.address"
+ },
+ "e225b2b0-1265-48db-a1c2-fbd251aa9a8f": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "URL",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "564cd5d2-cf08-424f-8e31-338441558078",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "secondaryFields": [],
+ "size": 10
+ },
+ "sourceField": "netbox.display_url"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "visualization": {
+ "columns": [
+ {
+ "columnId": "e225b2b0-1265-48db-a1c2-fbd251aa9a8f",
+ "width": 381.79999999999995
+ },
+ {
+ "columnId": "564cd5d2-cf08-424f-8e31-338441558078",
+ "hidden": true,
+ "isMetric": true,
+ "isTransposed": false
+ },
+ {
+ "columnId": "5cc286fc-7be1-4ebb-86ab-0fad7366bd77",
+ "isMetric": false,
+ "isTransposed": false
+ },
+ {
+ "columnId": "a181d11d-1687-4070-9f1b-d6bc8dbca58e",
+ "isMetric": false,
+ "isTransposed": false
+ }
+ ],
+ "layerId": "52d4f20d-8b1d-49af-89b4-b42230a056b1",
+ "layerType": "data",
+ "paging": {
+ "enabled": true,
+ "size": 10
+ }
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsDatatable"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": [
+ {
+ "action": {
+ "config": {
+ "encodeUrl": true,
+ "openInNewTab": true,
+ "url": {
+ "template": "{{event.values.[0]}}"
+ }
+ },
+ "factoryId": "URL_DRILLDOWN",
+ "name": "See in IP Address"
+ },
+ "eventId": "4ebdb3fe-140a-4341-9158-966e8020be39",
+ "triggers": [
+ "ROW_CLICK_TRIGGER"
+ ]
+ },
+ {
+ "action": {
+ "config": {
+ "encodeUrl": true,
+ "openInNewTab": true,
+ "url": {
+ "template": "{{event.values.[3]}}"
+ }
+ },
+ "factoryId": "URL_DRILLDOWN",
+ "name": "Go to Assigned Object"
+ },
+ "eventId": "264a7608-be82-4838-bfa5-d6279cd93539",
+ "triggers": [
+ "ROW_CLICK_TRIGGER"
+ ]
+ }
+ ]
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false
+ },
+ "gridData": {
+ "h": 17,
+ "i": "a4504f73-6bb8-4844-a943-239b7dca83a3",
+ "w": 30,
+ "x": 18,
+ "y": 0
+ },
+ "panelIndex": "a4504f73-6bb8-4844-a943-239b7dca83a3",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-671b7eda-aaa8-4f9a-b72e-19f04ce85d2d",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "671b7eda-aaa8-4f9a-b72e-19f04ce85d2d": {
+ "columnOrder": [
+ "6245c2fc-db26-46ad-9250-2dda0ca04f20",
+ "b823081c-bf29-416a-852e-fc2cd4dd205b"
+ ],
+ "columns": {
+ "6245c2fc-db26-46ad-9250-2dda0ca04f20": {
+ "customLabel": true,
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "IP Roles",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "b823081c-bf29-416a-852e-fc2cd4dd205b",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "secondaryFields": [],
+ "size": 10
+ },
+ "sourceField": "netbox.ip.role.value"
+ },
+ "b823081c-bf29-416a-852e-fc2cd4dd205b": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Unique count of netbox.ip.address",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.ip.address"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "visualization": {
+ "layers": [
+ {
+ "categoryDisplay": "default",
+ "colorMapping": {
+ "assignments": [],
+ "colorMode": {
+ "type": "categorical"
+ },
+ "paletteId": "default",
+ "specialAssignments": [
+ {
+ "color": {
+ "type": "loop"
+ },
+ "rules": [
+ {
+ "type": "other"
+ }
+ ],
+ "touched": false
+ }
+ ]
+ },
+ "layerId": "671b7eda-aaa8-4f9a-b72e-19f04ce85d2d",
+ "layerType": "data",
+ "legendDisplay": "default",
+ "metrics": [
+ "b823081c-bf29-416a-852e-fc2cd4dd205b"
+ ],
+ "nestedLegend": false,
+ "numberDisplay": "percent",
+ "primaryGroups": [
+ "6245c2fc-db26-46ad-9250-2dda0ca04f20"
+ ]
+ }
+ ],
+ "shape": "pie"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsPie"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "title": "IP Roles"
+ },
+ "gridData": {
+ "h": 17,
+ "i": "6488d433-743f-4bce-9975-d563787f4b59",
+ "w": 12,
+ "x": 0,
+ "y": 17
+ },
+ "panelIndex": "6488d433-743f-4bce-9975-d563787f4b59",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-caba48e6-858c-4077-a12e-030e9e8b581a",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "caba48e6-858c-4077-a12e-030e9e8b581a": {
+ "columnOrder": [
+ "1326f8c3-b44b-47c4-bb10-15d3845f1347",
+ "22e045c5-f8a0-433f-87b1-4c1d2b5411c7"
+ ],
+ "columns": {
+ "1326f8c3-b44b-47c4-bb10-15d3845f1347": {
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top 5 values of netbox.ip.status.value",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "22e045c5-f8a0-433f-87b1-4c1d2b5411c7",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": false,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "secondaryFields": [],
+ "size": 5
+ },
+ "sourceField": "netbox.ip.status.value"
+ },
+ "22e045c5-f8a0-433f-87b1-4c1d2b5411c7": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Unique count of netbox.ip.address",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.ip.address"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "visualization": {
+ "layers": [
+ {
+ "categoryDisplay": "default",
+ "colorMapping": {
+ "assignments": [
+ {
+ "color": {
+ "colorIndex": 0,
+ "paletteId": "default",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "active"
+ }
+ ],
+ "touched": false
+ },
+ {
+ "color": {
+ "colorIndex": 4,
+ "paletteId": "default",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "dhcp"
+ }
+ ],
+ "touched": true
+ },
+ {
+ "color": {
+ "colorIndex": 6,
+ "paletteId": "default",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "deprecated"
+ }
+ ],
+ "touched": true
+ },
+ {
+ "color": {
+ "colorIndex": 3,
+ "paletteId": "neutral",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "reserved"
+ }
+ ],
+ "touched": true
+ },
+ {
+ "color": {
+ "colorIndex": 9,
+ "paletteId": "default",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "raw",
+ "value": "slaac"
+ }
+ ],
+ "touched": true
+ }
+ ],
+ "colorMode": {
+ "type": "categorical"
+ },
+ "paletteId": "default",
+ "specialAssignments": [
+ {
+ "color": {
+ "colorIndex": 1,
+ "paletteId": "neutral",
+ "type": "categorical"
+ },
+ "rules": [
+ {
+ "type": "other"
+ }
+ ],
+ "touched": true
+ }
+ ]
+ },
+ "layerId": "caba48e6-858c-4077-a12e-030e9e8b581a",
+ "layerType": "data",
+ "legendDisplay": "default",
+ "metrics": [
+ "22e045c5-f8a0-433f-87b1-4c1d2b5411c7"
+ ],
+ "nestedLegend": false,
+ "numberDisplay": "percent",
+ "primaryGroups": [
+ "1326f8c3-b44b-47c4-bb10-15d3845f1347"
+ ]
+ }
+ ],
+ "shape": "pie"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsPie"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "title": "IP Status Overview"
+ },
+ "gridData": {
+ "h": 17,
+ "i": "f8a61e32-729d-430a-a8a0-d7dfb5e9e0e2",
+ "w": 10,
+ "x": 12,
+ "y": 17
+ },
+ "panelIndex": "f8a61e32-729d-430a-a8a0-d7dfb5e9e0e2",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-7e90126b-f09a-49e7-bae6-e3b174322c2c",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "7e90126b-f09a-49e7-bae6-e3b174322c2c": {
+ "columnOrder": [
+ "9fc127f4-a8e4-4f89-89d0-fe9516422ebd",
+ "049f344e-b6e2-4903-9176-b03675996d62"
+ ],
+ "columns": {
+ "049f344e-b6e2-4903-9176-b03675996d62": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Unique count of netbox.ip.address",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.ip.address"
+ },
+ "9fc127f4-a8e4-4f89-89d0-fe9516422ebd": {
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top 2 values of netbox.ip.family.label",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "049f344e-b6e2-4903-9176-b03675996d62",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "size": 2
+ },
+ "sourceField": "netbox.ip.family.label"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "visualization": {
+ "layers": [
+ {
+ "categoryDisplay": "default",
+ "colorMapping": {
+ "assignments": [],
+ "colorMode": {
+ "type": "categorical"
+ },
+ "paletteId": "default",
+ "specialAssignments": [
+ {
+ "color": {
+ "type": "loop"
+ },
+ "rules": [
+ {
+ "type": "other"
+ }
+ ],
+ "touched": false
+ }
+ ]
+ },
+ "emptySizeRatio": 0,
+ "layerId": "7e90126b-f09a-49e7-bae6-e3b174322c2c",
+ "layerType": "data",
+ "legendDisplay": "default",
+ "metrics": [
+ "049f344e-b6e2-4903-9176-b03675996d62"
+ ],
+ "nestedLegend": false,
+ "numberDisplay": "percent",
+ "primaryGroups": [
+ "9fc127f4-a8e4-4f89-89d0-fe9516422ebd"
+ ]
+ }
+ ],
+ "shape": "donut"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsPie"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "title": "IP Family Distribution"
+ },
+ "gridData": {
+ "h": 17,
+ "i": "6ea2d359-3a77-4487-ba23-820a16d69cfe",
+ "w": 13,
+ "x": 22,
+ "y": 17
+ },
+ "panelIndex": "6ea2d359-3a77-4487-ba23-820a16d69cfe",
+ "type": "lens"
+ },
+ {
+ "embeddableConfig": {
+ "attributes": {
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "indexpattern-datasource-layer-13a4afba-dce2-4f1c-836e-cd7fc6d0484d",
+ "type": "index-pattern"
+ }
+ ],
+ "state": {
+ "adHocDataViews": {},
+ "datasourceStates": {
+ "formBased": {
+ "layers": {
+ "13a4afba-dce2-4f1c-836e-cd7fc6d0484d": {
+ "columnOrder": [
+ "17bf155c-4cec-4d23-8c16-b10cfba825c9",
+ "f53b619c-320f-4634-aaaa-84f36398f5b3"
+ ],
+ "columns": {
+ "17bf155c-4cec-4d23-8c16-b10cfba825c9": {
+ "dataType": "string",
+ "isBucketed": true,
+ "label": "Top 10 values of netbox.ip.assigned_object_type",
+ "operationType": "terms",
+ "params": {
+ "exclude": [],
+ "excludeIsRegex": false,
+ "include": [],
+ "includeIsRegex": false,
+ "missingBucket": false,
+ "orderBy": {
+ "columnId": "f53b619c-320f-4634-aaaa-84f36398f5b3",
+ "type": "column"
+ },
+ "orderDirection": "desc",
+ "otherBucket": true,
+ "parentFormat": {
+ "id": "terms"
+ },
+ "secondaryFields": [],
+ "size": 10
+ },
+ "sourceField": "netbox.ip.assigned_object_type"
+ },
+ "f53b619c-320f-4634-aaaa-84f36398f5b3": {
+ "dataType": "number",
+ "isBucketed": false,
+ "label": "Unique count of netbox.ip.address",
+ "operationType": "unique_count",
+ "params": {
+ "emptyAsNull": true
+ },
+ "sourceField": "netbox.ip.address"
+ }
+ },
+ "incompleteColumns": {},
+ "sampling": 1
+ }
+ }
+ },
+ "indexpattern": {
+ "layers": {}
+ },
+ "textBased": {
+ "layers": {}
+ }
+ },
+ "filters": [],
+ "internalReferences": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "visualization": {
+ "layers": [
+ {
+ "categoryDisplay": "default",
+ "colorMapping": {
+ "assignments": [],
+ "colorMode": {
+ "type": "categorical"
+ },
+ "paletteId": "default",
+ "specialAssignments": [
+ {
+ "color": {
+ "type": "loop"
+ },
+ "rules": [
+ {
+ "type": "other"
+ }
+ ],
+ "touched": false
+ }
+ ]
+ },
+ "layerId": "13a4afba-dce2-4f1c-836e-cd7fc6d0484d",
+ "layerType": "data",
+ "legendDisplay": "default",
+ "metrics": [
+ "f53b619c-320f-4634-aaaa-84f36398f5b3"
+ ],
+ "nestedLegend": false,
+ "numberDisplay": "percent",
+ "primaryGroups": [
+ "17bf155c-4cec-4d23-8c16-b10cfba825c9"
+ ]
+ }
+ ],
+ "shape": "pie"
+ }
+ },
+ "title": "",
+ "type": "lens",
+ "visualizationType": "lnsPie"
+ },
+ "enhancements": {
+ "dynamicActions": {
+ "events": []
+ }
+ },
+ "filters": [],
+ "query": {
+ "language": "kuery",
+ "query": "data_stream.dataset : \"netbox.ips\" "
+ },
+ "syncColors": false,
+ "syncCursor": true,
+ "syncTooltips": false,
+ "title": "Assigned Object Types"
+ },
+ "gridData": {
+ "h": 17,
+ "i": "36b881a7-2f0c-49d7-b1bc-a0b674bf37aa",
+ "w": 13,
+ "x": 35,
+ "y": 17
+ },
+ "panelIndex": "36b881a7-2f0c-49d7-b1bc-a0b674bf37aa",
+ "type": "lens"
+ }
+ ],
+ "timeRestore": false,
+ "title": "[Logs Netbox] IP Addresses",
+ "version": 3
+ },
+ "coreMigrationVersion": "8.8.0",
+ "created_at": "2025-08-15T14:17:45.857Z",
+ "created_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
+ "id": "netbox-51662583-0923-4203-b806-9f41ece4df26",
+ "references": [
+ {
+ "id": "logs-*",
+ "name": "3562aee3-f7c2-4b5c-9c21-c9f23cf7953e:indexpattern-datasource-layer-3cdbde48-3b81-4b60-b7fd-33f7ec68cc7e",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "a4504f73-6bb8-4844-a943-239b7dca83a3:indexpattern-datasource-layer-52d4f20d-8b1d-49af-89b4-b42230a056b1",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "6488d433-743f-4bce-9975-d563787f4b59:indexpattern-datasource-layer-671b7eda-aaa8-4f9a-b72e-19f04ce85d2d",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "f8a61e32-729d-430a-a8a0-d7dfb5e9e0e2:indexpattern-datasource-layer-caba48e6-858c-4077-a12e-030e9e8b581a",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "6ea2d359-3a77-4487-ba23-820a16d69cfe:indexpattern-datasource-layer-7e90126b-f09a-49e7-bae6-e3b174322c2c",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "36b881a7-2f0c-49d7-b1bc-a0b674bf37aa:indexpattern-datasource-layer-13a4afba-dce2-4f1c-836e-cd7fc6d0484d",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_9aeac902-6a2b-4502-be29-a4856df30aff:optionsListDataView",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_657d77f2-77a5-4f1b-af21-78365de55e0a:optionsListDataView",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_cbcb39f4-634d-47f5-bd22-899abd192664:optionsListDataView",
+ "type": "index-pattern"
+ },
+ {
+ "id": "logs-*",
+ "name": "controlGroup_4a7f54fb-0199-4bca-a369-b75ef652d114:optionsListDataView",
+ "type": "index-pattern"
+ }
+ ],
+ "type": "dashboard",
+ "typeMigrationVersion": "10.3.0",
+ "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
+}
diff --git a/packages/netbox/manifest.yml b/packages/netbox/manifest.yml
new file mode 100644
index 00000000000..0f3b057d91b
--- /dev/null
+++ b/packages/netbox/manifest.yml
@@ -0,0 +1,93 @@
+format_version: 3.4.1
+name: netbox
+title: "NetBox"
+version: 0.0.1
+source:
+ license: "Elastic-2.0"
+description: "Collect logs from NetBox with Elastic Agent"
+type: integration
+categories:
+ - network
+ - security
+ - web
+conditions:
+ kibana:
+ version: "^9.1.0"
+ elastic:
+ subscription: "basic"
+screenshots:
+ - src: /img/devices-dashboard-overview.png
+ title: Devices overview
+ size: 600x600
+ type: image/png
+ - src: /img/ips-dashboard-overview.png
+ title: IP Addresses overview
+ size: 600x600
+ type: image/png
+icons:
+ - src: /img/netbox-logo.svg
+ title: Sample logo
+ size: 32x32
+ type: image/svg+xml
+policy_templates:
+ - name: netbox
+ title: NetBox logs
+ description: Collect logs from NetBox
+ inputs:
+ - type: httpjson
+ title: Collect logs from NetBox API
+ description: Collecting assets from the NetBox API
+ vars:
+ - name: url
+ type: text
+ title: URL of NetBox API Server
+ description: The url of your NetBox API Server
+ show_user: true
+ required: true
+ default: https://localhost:8000
+ - name: enable_request_tracer
+ type: bool
+ title: Enable request tracing
+ multi: false
+ required: false
+ show_user: false
+ description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.
+ - name: token
+ type: password
+ title: Netbox Authorization Token
+ description: |
+ Token, e.g. "eyJhbGciO..."
+ show_user: true
+ required: true
+ secret: true
+ - name: http_client_timeout
+ type: text
+ title: HTTP Client Timeout
+ description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.
+ multi: false
+ required: false
+ show_user: true
+ - name: proxy_url
+ type: text
+ title: Proxy URL
+ description: URL to proxy connections in the form of http\[s\]://:@:
+ multi: false
+ required: false
+ show_user: false
+ - name: ssl
+ type: yaml
+ title: SSL Configuration
+ description: SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.
+ multi: false
+ required: false
+ show_user: false
+ - name: disable_keep_alive
+ required: true
+ show_user: false
+ title: Disable HTTP Keep-Alives
+ description: Controls whether HTTP keep-alives are disabled.
+ type: bool
+ multi: false
+owner:
+ github: elastic/obs-infraobs-integrations
+ type: elastic