17fb37f075
Most of the changes in this PR are for style and to adapt the playbooks so that the system can operate on a multi-node cloud. Functional change includes the removal of mainline Java 8 in favor of OpenJDK 8. A site playbook was add to allow an operator to just run everything. Old tools that no longer function within the stack have been removed. Packetbeat was added to the install list Auditbeat was added to the install list All of the config files have been updated for the recent ElasticStack 6.x changes. Change-Id: I01200ad4772ff200b9c5c93f8f121145dfb88170 Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
51 lines
1.3 KiB
YAML
51 lines
1.3 KiB
YAML
---
|
|
- name: Install Packetbeat
|
|
hosts: all
|
|
become: true
|
|
vars:
|
|
haproxy_ssl: false
|
|
|
|
vars_files:
|
|
- vars/variables.yml
|
|
|
|
pre_tasks:
|
|
- include_tasks: common_task_install_elk_repo.yml
|
|
|
|
- name: Ensure packetbeat is installed
|
|
apt:
|
|
name: packetbeat
|
|
state: present
|
|
update_cache: true
|
|
|
|
post_tasks:
|
|
- name: Drop packetbeat conf file
|
|
template:
|
|
src: templates/packetbeat.yml.j2
|
|
dest: /etc/packetbeat/packetbeat.yml
|
|
|
|
- name: Enable and restart packetbeat
|
|
systemd:
|
|
name: "packetbeat"
|
|
enabled: true
|
|
state: restarted
|
|
|
|
|
|
- name: Load Packetbeat Dashboards
|
|
hosts: all[0]
|
|
become: true
|
|
vars_files:
|
|
- vars/variables.yml
|
|
tasks:
|
|
- name: Load templates
|
|
shell: >-
|
|
{% set IP_ARR=[] %}
|
|
{% for host in groups['elastic-logstash'] %}
|
|
{% if IP_ARR.insert(loop.index,hostvars[host]['ansible_host']) %}
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% set elasticsearch_hosts = [IP_ARR | map('regex_replace', '$', ':' ~ elastic_port|string()) | map('regex_replace', '$', '"') | map('regex_replace', '^', '"') | list | join(',' )] %}
|
|
packetbeat setup
|
|
-E 'output.logstash.enabled=false'
|
|
-E 'output.elasticsearch.hosts={{ elasticsearch_hosts }}'
|
|
-e -v
|