Ansible Role: Filebeat

This Ansible role installs Filebeat on RedHat/CentOS systems.

It installs and sets up the latest version of Filebeat (6.x) from the official Elastic.co repository.

Requirements

No special requirements.

Role Variables

Default values (found in defaults/main.yml):

es_major_version: "6.x"

Make sure the Filebeat version matches the major version of Elasticsearch in your ELK stack.

es_use_repository: undefined

This variable is not defined in the role itself, but it's usually set in the elastic.elasticsearch role. If you are using that role to install Elasticsearch, it will set up the repository automatically. If you disable repository installation in that role, this Filebeat role will create it.

es_version: "6.2.3"

This is the complete version number of Elasticsearch/Filebeat.

filebeat_create_config: "true"

Determines if the role should create the Filebeat configuration file.

filebeat_enabled: "yes"

Specifies whether the Filebeat service should start on boot.

filebeat_repo_key: 'https://artifacts.elastic.co/GPG-KEY-elasticsearch'

The URL for the PGP key needed for the Elastic.co repository.

filebeat_run_state: started

Indicates whether the Filebeat service should be running.

filebeat_config_content:
  filebeat.prospectors:
    - type: log
      enabled: "true"
      paths:
        - "/var/log/*.log"
  filebeat.config.modules:
    reload.enabled: "false"
    path: "{{ filebeat_modules_dir }}/*.yml"
  setup.template.settings:
    index.number_of_shards: 3
  output.elasticsearch:
    hosts:
      - "localhost:9200"

This variable holds Filebeat's basic configuration. It will be used to create the filebeat.yml file. You will typically want to define keys like:

• filebeat.prospectors
• filebeat.config.modules
• setup.template.settings
• Output settings, like output.elasticsearch or output.logstash

filebeat_module_config: {}

This variable works like filebeat_config_content, but it's for configuring Filebeat modules. The keys are module names and their values are configuration settings.

For example:

filebeat_module_config:
  system:
    syslog:
      enabled: "true"
    auth:
      enabled: "true"

RedHat-specific values (found in vars/filebeat-RedHat.yml)

filebeat_home: /usr/share/filebeat

Path where Filebeat is installed.

filebeat_bin_dir: "{{ filebeat_home }}/bin"

Path for the Filebeat binary.

filebeat_config_dir: "/etc/filebeat"

Path to the Filebeat configuration directory.

filebeat_config_file: "{{ filebeat_config_dir }}/filebeat.yml"

Full path to the Filebeat configuration file.

filebeat_modules_dir: "{{ filebeat_config_dir }}/modules.d"

Path where Filebeat module configurations are stored.

Dependencies

None.

Example Playbook

- hosts: servers
  roles:
     - role: javiergayala.filebeat
       filebeat_module_config:
         system:
           syslog:
             enabled: "true"
           auth:
             enabled: "true"

License

BSD

Author Information

This role was created in 2018 by Javier Ayala.