geerlingguy / ansible-role-logstash-forwarder Goto Github PK

View Code? Open in Web Editor NEW

22.0 2.0 29.0 18 KB

DEPRECATED Ansible Role - Logstash Forwarder

Home Page: https://galaxy.ansible.com/geerlingguy/logstash-forwarder/

License: MIT License

Shell 100.00%

ansible role logstash elk logstash-forwarder logging

ansible-role-logstash-forwarder's Introduction

Ansible Role: Logstash Forwarder

DEPRECATED: This role is deprecated, as Logstash Forwarder has been deprecated and is replaced by Filebeat. Please use the geerlingguy.filebeat role instead.

An Ansible Role that installs Logstash Forwarder on RedHat/CentOS or Debian/Ubuntu.

Note: This role is well-tested on Debian/Ubuntu, but is still undergoing development for RedHat/CentOS. You've been warned!

Requirements

None.

Role Variables

Available variables are listed below, along with default values (see defaults/main.yml):

logstash_forwarder_logstash_server: localhost
logstash_forwarder_logstash_server_port: 5000

The central Logstash server/port to which logstash-forwarder should connect.

logstash_ssl_dir: /etc/pki/logstash
logstash_forwarder_ssl_certificate_file: logstash-forwarder-example.crt

The location and filename of the SSL certificate logstash-forwarder will use to authenticate to the logstash server. For the logstash_forwarder_ssl_certificate_file, you can provide a path relative to the role directory, or an absolute path to the file.

logstash_forwarder_files:
  - paths:
      - /var/log/messages
      - /var/log/auth.log
    fields:
      type: syslog

Configuration of files monitored by logstash-forwarder. You can add more sets of files by adding to the list with another set of files; see defaults/main.yml for an example.

Dependencies

None.

Example Playbook

- hosts: all
  roles:
    - { role: geerlingguy.logstash-forwarder }

License

MIT / BSD

Author Information

This role was created in 2014 by Jeff Geerling, author of Ansible for DevOps.

ansible-role-logstash-forwarder's People

Contributors

Stargazers

Watchers

ansible-role-logstash-forwarder's Issues

Logstash Forwarder is deprecated - Use Beats instead

It looks like the upstream project has been superseded by Beats. Need to create a new role for it, document some sort of migration path/how to switch, and then mark this role as deprecated.

Fails on debian wheezy

TASK: [geerlingguy.logstash-forwarder | Ensure logstash-forwarder is started and enabled on boot.] ***
failed: [website] => {"failed": true}
msg: update-rc.d: error: no runlevel symlinks to modify, aborting!

Logstash Forwarder repository is AWOL

See: elastic/logstash-forwarder#184.

We might have to build logstash-forwarder from source, which apparently involves installing Go and then building the binary with go build.

I'm going to leave this open for now in hopes that someone will step up and offer a package-based install, though... it would be much more convenient.

Failed to start logstash-forwarder.service

Hi geerlingguy

I've got some trouble with this role, the service logstash-forwarder can't start

The ansible output return

TASK: [geerlingguy.logstash-forwarder | Ensure logstash-forwarder is started and enabled on boot.] *** 
failed: [10.0.0.50] => {"failed": true}
msg: Failed to start logstash-forwarder.service: Unit logstash-forwarder.service failed to load: No such file or directory.

I'm running a debian/jessie64 box on vagrant

thx

Mode of logstash-forwarder.deb.init script should be 0755

otherwise update-rc.d is not able to create the run level links.
With the current mode 0655 I get the following:

root@logs:~# update-rc.d logstash-forwarder defaults
update-rc.d: using dependency based boot sequencing
insserv: script logstash-forwarder is not an executable regular file, skipped!
root@logs:~# ls -l /etc/init.d/logstash-forwarder 
-rw-r-xr-x 1 root root 2755 Nov 30 21:39 /etc/init.d/logstash-forwarder

After changing the mode to 0755 in setup-Debian.yml the role is working for me.

Need python-pycurl as dependency

Came across this:

TASK: [geerlingguy.logstash-forwarder | Add logstash-forwarder repository.] *** 
failed: [fe-lb2] => {"failed": true, "item": ""}
msg: Could not import python modules: pycurl. Please install python-pycurl package.

FATAL: all hosts have already failed -- aborting

Not sure if, but it seems this role should pick this up, not "me" as an enduser of the role.