Ansible Role for FileBeat

This is an Ansible Role that installs FileBeat on Red Hat/CentOS or Debian/Ubuntu systems.

Tested On

• EL / CentOS (6 / 7)
• Debian (Wheezy / Jessie)
• Ubuntu (Trusty / Xenial)
• Solaris

Role Variables

Here are the available variables along with their default values found in defaults/main.yml.

FileBeat user and group: If you run FileBeat with a user other than root, ensure that the logs are accessible to the FileBeat user. You might need to add the FileBeat user to a group that can access your logs.

• On Ubuntu, add the user to the adm group.
• On CentOS, you can change permissions using the setfacl command, like this: sudo setfacl -m g:filebeat:r <path>.

filebeat_user: root
filebeat_group: root

Create the filebeat user and group.

filebeat_create_user: true

FileBeat version to use.

filebeat_version: 6.3.0

Use the FileBeat apt repository. You can specify a URL to install a specific version. Set filebeat_use_repo to false and optionally modify filebeat_package_baseurl.

filebeat_use_repo: true

Base URL for package download if filebeat_use_repo: false.

filebeat_deb_baseurl: "https://artifacts.elastic.co/downloads/beats/filebeat"

Start FileBeat automatically on boot.

filebeat_start_at_boot: true

FileBeat upgrade setting. This option allows you to upgrade the package.

filebeat_upgrade: false

Path to FileBeat configuration file.

filebeat_config_file: /etc/filebeat/filebeat.yml

Path to FileBeat registry file.

filebeat_config_registry_file: /var/lib/filebeat/registry

The FileBeat configuration is created using the variable filebeat_config, which is made up of several other variables for easier management:

• filebeat_config_prospectors
• filebeat_config_output
• filebeat_config_shipper
• filebeat_config_logging

Here is an example structure:

filebeat_config_prospectors: |
  filebeat:
    prospectors:
      -
        input_type: log
        paths:
          - /var/log/*.log
        registry_file: "{{filebeat_config_registry_file}}"
filebeat_config_output: |
  output:
    elasticsearch:
      hosts: [ 'localhost:9200' ]
filebeat_config_shipper: |
  shipper:
filebeat_config_logging: |
  logging:
    files:
      rotateeverybytes: 10485760 # = 10MB
filebeat_config: |
  {{filebeat_config_prospectors}}
  {{filebeat_config_output}}
  {{filebeat_config_shipper}}
  {{filebeat_config_logging}}

FileBeat templates (list of templates to install). These will be copied to the /etc/filebeat directory and can be used in the Elasticsearch output.

For more info: https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#_template

filebeat_templates: []

Usage

To use the role, you can write:

- hosts: logging
  roles:
    - { role: torian.filebeat }

License

Check License for details.

Author Information

This role was created in 2016 by Emiliano Castagnari.