packetbeat-deploy icon indicating copy to clipboard operation
packetbeat-deploy copied to clipboard

Numerous fixes for logstash shipper, group/host overrides, permissions,

Open CaptTofu opened this issue 10 years ago • 0 comments

Greetings! I have been using this great repository for testing out a logstash setup and had numerous tweaks I made to it.

Primarily:

  • Fixed the logstash agent to have permissions to read the log files since the process runs as the logstash user using the acl package
  • Changed vars for logstash and packetbeat roles to defaults so that they can be over-ridden by group_vars or host_vars. Why? So the deployer doesn't have to modify the repository directly in case long term one might like to see this as a galaxy module
  • Changed the composition of the dictionaries for packetbeat and logstash so that they can be over-ridden with group_vars and host_vars without overriding more global settings defined in defaults.
  • Added a beaver role. Beaver is worlds easier to get working as well as many will balk at running an entire JVM to ship logs on smaller boxes.
  • Added a work-around to the fact that logstash on the aggregator wasn't being set up so that that init files are linked to run-levels. A restart of a server and lack of running logstash and logstash-web revealed this.

CaptTofu avatar Jul 29 '15 14:07 CaptTofu