Ansible Role for Logstash

This Ansible role installs Logstash using official repository packages.

Supported Platforms

• EL / CentOS (6 / 7)
• Debian (Wheezy / Jessie)
• Ubuntu (Precise / Trusty)
• AMZ Linux

Role Variables

The role variables are located in defaults/main.yml. You can check this file for detailed explanations.

logstash_version: 5.6.4

logstash_daemon_user: root

logstash_install_dir: /usr/share/logstash
logstash_conf_prefix:  /etc/logstash
logstash_conf_dir:    "{{logstash_conf_prefix}}/conf.d"
logstash_data_dir:    /var/lib/logstash

logstash_plugins:
  - logstash-input-s3
  - logstash-output-s3

The default settings for JVM config (jvm.options) are based on the values provided by Logstash:

logstash_jvm_mem: 1g

logstash_config_jvm_defaults: |
  -Xms{{logstash_jvm_mem}}
  -Xmx{{logstash_jvm_mem}}
  -XX:+UseParNewGC
  -XX:+UseConcMarkSweepGC
  -XX:CMSInitiatingOccupancyFraction=75
  -XX:+UseCMSInitiatingOccupancyOnly
  -XX:+DisableExplicitGC
  -Djava.awt.headless=true
  -Dfile.encoding=UTF-8
  -XX:+HeapDumpOnOutOfMemoryError

logstash_config_jvm: "{{logstash_config_jvm_defaults}}"

The default settings for the daemon config (logstash.yml) come from Logstash. The values for logstash_config_daemon_defaults and logstash_config_daemon are combined using the Jinja2 filter combine():

logstash_config_daemon_defaults:
  path.data: "{{logstash_data_dir}}"
  path.config: "{{logstash_conf_dir}}"
  path.logs: "{{logstash_logs_dir}}"

logstash_config_daemon: {}

Usage

To configure input, filter, and output, use these special variables:

• logstash_inputs
• logstash_filters
• logstash_outputs

These variables create sections input {}, filter {}, and output {}. You can customize the configuration as needed, for example:

---
- hosts: all

  vars:
    - logstash_inputs: |
        file {
            path => "/var/log/nginx/access.log"
            tags => ["nginx"]
        }
        file {
            path => "/var/log/nginx/error.log"
            tags => ["nginx"]
        }

    - logstash_filters: |
        grok { match => [ "message", "%{HTTPDATE:[@metadata][timestamp]}" ] }
        date { match => [ "[@metadata][timestamp]", "dd/MMM/yyyy:HH:mm:ss Z" ] }

    - logstash_outputs: |
        stdout { codec => rubydebug }


  roles:
    - { role: torian.logstash}

Installing Additional Plugins

By default, the role installs two plugins:

logstash_plugins:
  - logstash-input-s3
  - logstash-output-s3

If you don’t need these, or want different plugins, just change the default settings.

Upgrading Logstash Version

To upgrade from an earlier version of Logstash, use the variable logstash_upgrade=True. This will make the package manager install the latest available version that matches the major version of logstash_version.