62 lines
1.7 KiB
Markdown
62 lines
1.7 KiB
Markdown
# Mandatory variables
|
|
Define the elastic repository version that will determine the version of filebeat:
|
|
```
|
|
elastic_major_version: "7.x"
|
|
```
|
|
Define the list of logstash endpoint where to send the logs:
|
|
Define the output for the logs, it can be either elasticsearch or logstash:
|
|
```
|
|
filebeat_output_elasticsearch_hosts:
|
|
- host1
|
|
- host2
|
|
```
|
|
or
|
|
```
|
|
filebeat_output_logstash_hosts:
|
|
- host1
|
|
- host2
|
|
```
|
|
If you use elasticsearch, the connection will use https and use the login/password of the server to authenticate itself.
|
|
You can change the protocol to http with:
|
|
```
|
|
filebeat_output_elasticsearch_protocol: "http"
|
|
```
|
|
# Optional variables
|
|
You can disable this filebeat role by setting this variable :
|
|
```yaml
|
|
filebeat_install: false
|
|
```
|
|
|
|
By default, filebeat will send the system logs to the index `logs-infra-system` and the other logs to `logs-{{ talas_project }}-{{ talas_group }}`.
|
|
|
|
Sometime, you want to send _all_ logs (even for the system), to the `logs-{{ talas_project }}-{{ talas_group }}` index.
|
|
|
|
If this is the case, you need to set this variable to false:
|
|
```
|
|
filebeat_separate_system_logs: false
|
|
```
|
|
|
|
You can define the loglevel of filebeat, the default is `warning`, possible values are error, warning, info, debug:
|
|
```
|
|
filebeat_logging_level: "warning"
|
|
```
|
|
# Modules
|
|
The `system` module is always enabled.
|
|
|
|
This role will automatically detect the installation of the following software and enable the correct modules:
|
|
- apache httpd
|
|
- elasticsearch
|
|
- haproxy
|
|
- kibana
|
|
- logstash
|
|
|
|
You can add more module by creating this list:
|
|
```
|
|
filebeat_modules_list:
|
|
- system
|
|
```
|
|
You can see the list of modules with `filebeat modules list`.
|
|
|
|
# Update
|
|
|
|
You can perform an update of filebeat by adding: `--extra-vars '{ "filebeat_update" : true }'`
|