This is a Chef cookbook to manage Filebeat.
https://github.com/vkhatri/chef-filebeat
This cookbook was tested on Amazon & Ubuntu Linux and expected to work on other RHEL platforms.
-
filebeat::default
- default recipe (use it for run_list) -
filebeat::install
- install filebeat -
filebeat::config
- configure filebeat
-
default['filebeat']['version']
(default:1.0.0-beta4
): filebeat version -
default['filebeat']['package_url']
(default:calculated
): package download url -
default['filebeat']['conf_dir']
(default:/etc/filebeat
): filebeat yaml configuration file directory -
default['filebeat']['conf_file']
(default:/etc/filebeat/filebeat.yml
): filebeat configuration file -
default['filebeat']['notify_restart']
(default:true
): whether to restart filebeat service on configuration file change -
default['filebeat']['disable_service']
(default:false
): whether to stop and disable filebeat service -
default['filebeat']['enable_localhost_output']
(default:true
): by default add localhosthosts
for outputelasticsearch
andlogstash
-
default['filebeat']['prospectors_dir']
(default:/etc/filebeat/conf.d
): prospectors configuration file directory -
default['filebeat']['prospectors']
(default:{}
): prospectors configuration file
-
default['filebeat']['config']['filebeat']['prospectors']
(default:[]
): filebeat interface device name -
default['filebeat']['config']['filebeat']['registry_file']
(default:/var/lib/filebeat/registry
): filebeat services to capture packets -
default['filebeat']['config']['filebeat']['config_dir']
(default:node['filebeat']['prospectors_dir']
): filebeat prospectors configuration files folder -
default['filebeat']['config']['output']['elasticsearch']['enabled']
(default:true
): enable elasticsearch output -
default['filebeat']['config']['output']['elasticsearch']['hosts']
(default:[]
): elasticsearch hosts -
default['filebeat']['config']['output']['elasticsearch']['save_topology']
(default:false
): -
default['filebeat']['config']['output']['logstash']['enabled']
(default:true
): enable logstash output -
default['filebeat']['config']['output']['logstash']['hosts']
(default:[]
): logstash hosts -
default['filebeat']['config']['output']['logstash']['loadbalance']
(default:true
): set true to load balance between logstash hosts -
default['filebeat']['config']['output']['logstash']['index']
(default:filebeat
): logstash index name -
default['filebeat']['config']['output']['logstash']['tls']['enabled']
(default:false
): -
default['filebeat']['config']['output']['logstash']['save_topology']
(default:false
): -
default['filebeat']['config']['output']['file']['enabled']
(default:false
): -
default['filebeat']['config']['output']['file']['path']
(default:/tmp/filebeat
): -
default['filebeat']['config']['output']['file']['filename']
(default:filebeat
): -
default['filebeat']['config']['output']['file']['rotate_every_kb']
(default:10240
): -
default['filebeat']['config']['output']['file']['number_of_files']
(default:7
):
For more attribute info, visit below links:
https://github.com/elastic/filebeat/blob/master/etc/filebeat.yml
Individual propspectors configuration file can be added using attribute default['filebeat']['prospectors']
. Each prospector configuration will
be created as a different yaml file under default['filebeat']['prospector_dir']
with prefix prospector-
"default_attributes": {
"filebeat": {
"prospectors": {
"system_logs": {
"filebeat": {
"prospectors": [
{
"paths": [
"/var/log/messages",
"/var/log/syslog"
],
"type": "log",
"fields": {
"type": "system_logs"
}
}
]
}
},
"secure_logs": {
"filebeat": {
"prospectors": [
{
"paths": [
"/var/log/secure",
"/var/log/auth.log"
],
"type": "log",
"fields": {
"type": "secure_logs"
}
}
]
}
},
"apache_logs": {
"filebeat": {
"prospectors": [
{
"paths": [
"/var/log/apache/*.log"
],
"type": "log",
"ignore_older": "24h",
"scan_frequency": "15s",
"harvester_buffer_size": 16384,
"fields": {
"type": "apache_logs"
}
}
]
}
}
}
}
}
Above configuration will create three different prospector files - prospector-system_logs.yml, prospector-secure_logs.yml and prospector-apache_logs.yml
- Fork the repository on Github
- Create a named feature branch (like
add_component_x
) - Write your change
- Write tests for your change (if applicable)
- Run the tests (
rake & rake knife
), ensuring they all pass - Write new resource/attribute description to
README.md
- Write description about changes to PR
- Submit a Pull Request using Github
Authors:: Virender Khatri and Contributors
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.