filebeat

Ansible Filebeat role

Installs Elastic's Filebeat for forwarding logs.

Role Variables

filebeat_version - The version of filebeat to install. Defaults to 6.4.2.
filebeat_state - Defaults to present. Set it to absent to uninstall filebeat.
filebeat_config - YAML representation of your filebeat config. This is templated directly into the configuration file as YAML. See the example configuration for an exhaustive list of configuration options. Defaults to:

filebeat_config:
  filebeat:
    prospectors:
      - paths:
          - /var/log/messages
          - /var/log/*.log
        input_type: log
  output:
    file:
      path: /tmp/filebeat
      filename: filebeat
  logging:
    to_syslog: true
    level: error

filebeat_ca_cert - If provided, the contents of this variable will be placed into the file identified by filebeat_ca_path on the target host. You can then include the filebeat_ca_path within your configuration to properly authenticate your TLS connections to Logstash/Elasticsearch/etc.

If you wish to load your CA certificate from a file, use the file lookup plugin, e.g.:

filebeat_ca_cert: "{{ lookup('file', '/path/to/ca.crt') }}"

filebeat_ca_path - If a CA certificate is provided in filebeat_ca_cert, it will be created at this path.

Similar to the CA variables, you can upload SSL certificates and keys for filebeat using these variables:

filebeat_ssl_cert - Contents of the SSL certificate
filebeat_ssl_cert_path - Destination of the certificate on the Ansible controlled host
filebeat_ssl_key - Contents of the SSL key
filebeat_ssl_key_path - Destination of the SSL key on the Ansible controlled host

You can also store the config in separate filebeat.yml file and include it using lookup:

filebeat_config: "{{ lookup('file', './filebeat.yml')|from_yaml }}"

Common Configurations

Connecting to Elasticsearch:

filebeat_config:
  filebeat:
    prospectors:
      - paths:
          - /var/log/messages
          - /var/log/*.log
        input_type: log
  output:
    elasticsearch:
      hosts:
        - "http://localhost:9200"
      username: "bob"
      password: "12345"
  logging:
    to_syslog: true
    level: error