DavidWittman.filebeat

Ansible Filebeat Role

This role installs Elastic's Filebeat to send logs.

Role Variables

filebeat_version - The version of Filebeat to install. Default is 6.4.2.
filebeat_state - Default is present. Change to absent to remove Filebeat.
filebeat_config - Your Filebeat configuration in YAML format. This is added directly as YAML in the config file. For a full list of options, see the example configuration. The default is:

filebeat_config:
  filebeat:
    prospectors:
      - paths:
          - /var/log/messages
          - /var/log/*.log
        input_type: log
  output:
    file:
      path: /tmp/filebeat
      filename: filebeat
  logging:
    to_syslog: true
    level: error

filebeat_ca_cert - If you provide this, its content will go into the file specified by filebeat_ca_path on the target machine. You can then include filebeat_ca_path in your configuration for TLS authentication with Logstash/Elasticsearch/etc.

To load your CA certificate from a file, use the file lookup plugin, like this:

filebeat_ca_cert: "{{ lookup('file', '/path/to/ca.crt') }}"

filebeat_ca_path - If you provide a CA certificate, it will be created at this path.

For SSL certificates and keys for Filebeat, use these variables:

filebeat_ssl_cert - SSL certificate content
filebeat_ssl_cert_path - Where to put the certificate on the Ansible-controlled host
filebeat_ssl_key - SSL key content
filebeat_ssl_key_path - Where to put the SSL key on the Ansible-controlled host

You can also keep the config in a separate filebeat.yml file and use lookup to include it:

filebeat_config: "{{ lookup('file', './filebeat.yml')|from_yaml }}"

Common Configurations

To connect to Elasticsearch:

filebeat_config:
  filebeat:
    prospectors:
      - paths:
          - /var/log/messages
          - /var/log/*.log
        input_type: log
  output:
    elasticsearch:
      hosts:
        - "http://localhost:9200"
      username: "bob"
      password: "12345"
  logging:
    to_syslog: true
    level: error