packetbeat-deploy
packetbeat-deploy copied to clipboard
Numerous fixes for logstash shipper, group/host overrides, permissions,
Greetings! I have been using this great repository for testing out a logstash setup and had numerous tweaks I made to it.
Primarily:
- Fixed the logstash agent to have permissions to read the log files since the process runs as the logstash user using the acl package
- Changed vars for logstash and packetbeat roles to defaults so that they can be over-ridden by group_vars or host_vars. Why? So the deployer doesn't have to modify the repository directly in case long term one might like to see this as a galaxy module
- Changed the composition of the dictionaries for packetbeat and logstash so that they can be over-ridden with group_vars and host_vars without overriding more global settings defined in defaults.
- Added a beaver role. Beaver is worlds easier to get working as well as many will balk at running an entire JVM to ship logs on smaller boxes.
- Added a work-around to the fact that logstash on the aggregator wasn't being set up so that that init files are linked to run-levels. A restart of a server and lack of running logstash and logstash-web revealed this.