-
Notifications
You must be signed in to change notification settings - Fork 1
/
CentOS7x_Install-Logstash-playbook.yml
155 lines (127 loc) · 4.81 KB
/
CentOS7x_Install-Logstash-playbook.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
---
################################################################################
# description: Installs Logstash on CentOS7x
# usage: ansible-playbook CentOS7x_Install-Logstash-playbook.yml --extra-vars 'HostOrGroup=YourServerOrGroupNameGoesHere ElasticsearchIP=IPAddressHere'
# author: Ernest G. Wilson II <[email protected]> (https://github.com/ernestgwilsonii)
# license: MIT
################################################################################
# Ansible Playbook options
# REF: http://docs.ansible.com/ansible/playbooks.html
#####################################################
- name: Install Logstash on CentOS7x
hosts: "{{ HostOrGroup|default ('FATAL ERROR --> HostOrGroup NOT SET! You must specify either a Host or a Group name!') }}"
serial: "100%"
gather_facts: False
tasks:
# Install or configure repository used on the OS by yum
# REF: https://docs.ansible.com/ansible/yum_repository_module.html
##################################################################
# /etc/yum.repos.d/elasticsearch.repo
- name: Install repository Elasticsearch
yum_repository:
name: elasticsearch
description: Elasticsearch repository
file: elasticsearch
baseurl: https://artifacts.elastic.co/packages/5.x/yum
enabled: yes
gpgcheck: yes
gpgkey: https://packages.elastic.co/GPG-KEY-elasticsearch
# Install yum packages
# REF: http://docs.ansible.com/ansible/yum_module.html
######################################################
- name: Install logstash
yum:
name=logstash
state=latest
# Restart firewalld to make sure it is running OK before changing any rules
# REF: http://docs.ansible.com/ansible/service_module.html
##########################################################
- name: Ensure the firewalld service is enabled and re-started before changing any rules
service:
name=firewalld
enabled=yes
state=restarted
# Update the firewalld configuration
# REF: http://docs.ansible.com/ansible/firewalld_module.html
############################################################
- name: Update firewall to allow port UDP 162 for incoming Logstash snmptrap connections
firewalld:
port=162/udp
permanent=true
immediate=yes
state=enabled
zone=public
- name: Update firewall to allow port UDP 514 for incoming Logstash Syslog connections
firewalld:
port=514/udp
permanent=true
immediate=yes
state=enabled
zone=public
- name: Update firewall to allow port TCP 514 for incoming Logstash Syslog connections
firewalld:
port=514/tcp
permanent=true
immediate=yes
state=enabled
zone=public
- name: Update firewall to allow port TCP 5044 for incoming Logstash Beats connections
firewalld:
port=5044/tcp
permanent=true
immediate=yes
state=enabled
zone=public
- name: Update firewall to allow port TCP 9600 for incoming Logstash API endpoint connections
firewalld:
port=9600/tcp
permanent=true
immediate=yes
state=enabled
zone=public
- name: Update firewall to allow port TCP 9601 for incoming Logstash API endpoint connections
firewalld:
port=9601/tcp
permanent=true
immediate=yes
state=enabled
zone=public
# Use the template module to populate files with data
# REF: http://docs.ansible.com/ansible/template_module.html
###########################################################
# /etc/logstash/logstash.yml
- name: Fill in the variables and copy templates/Logstash/logstash.yml.j2 to remote /etc/logstash/logstash.yml
template:
src=templates/Logstash/logstash.yml.j2
dest=/etc/logstash/logstash.yml
owner=root
group=root
mode=0644
# /etc/logstash/conf.d/logstash.conf
- name: Fill in the variables and copy templates/Logstash/logstash.conf.j2 to remote /etc/logstash/conf.d/logstash.conf
template:
src=templates/Logstash/logstash.conf.j2
dest=/etc/logstash/conf.d/logstash.conf
owner=root
group=root
mode=0644
# Enable and start Logstash
# REF: http://docs.ansible.com/ansible/service_module.html
##########################################################
- name: Enable and start the logstash service
service:
name=logstash
enabled=yes
state=restarted
# Note: Verify Logstash via SSH command line:
# systemctl status logstash
# service logstash status
# cat /var/log/logstash/logstash.log
# cat /etc/logstash/conf.d/logstash.conf
# cat /var/log/logstash/logstash.err
# cat /var/log/logstash/logstash.stdout
# cat /etc/logrotate.d/logstash
# cat /etc/logstash/logstash.yml
# cat /var/log/logstash/logstash-plain.log
# ss -ntlup | grep 5044 # Beats port
# ss -ntlup | grep 9600 # Logstash API endpoint port