Add Journalbeat support for OS LXC containers

Journalbeat currently only parses systemd journals
with machine UUID corresponding to the host, requiring
a separate journalbeat install to each OS container,
even when the container journals are present on the
host as subdirectories of /var/log/journal/.

This commit searches for these directories and adds
them to the Journalbeat journal path such that the
container journals are processed by the Journalbeat
instance on the physical host. This therefore removes
the need for Journalbeat to be deployed to each LXC
container.

Change-Id: Ifdfc8c52364d02fb2a0ca296b8c41c3d32bc0342

elk_metrics_7x/roles/elastic_journalbeat/tasks/main.yml

@@ -77,6 +77,16 @@
   notify:
     - Enable and restart journalbeat
 
+- name: Gather list of OS container journals
+  find:
+    path: "/var/log/journal/"
+    file_type: directory
+  register: journal_log_dirs
+
+- name: Set container journal paths
+  set_fact:
+    journal_paths: "{{ journal_log_dirs.files | map(attribute='path') | list }}"
+
 - name: Drop journalbeat configs
   template:
     src: "{{ item.src }}"

elk_metrics_7x/roles/elastic_journalbeat/templates/journalbeat.yml.j2

@@ -17,7 +17,7 @@ journalbeat.inputs:
   # Paths that should be crawled and fetched. Possible values files and directories.
   # When setting a directory, all journals under it are merged.
   # When empty starts to read from local journal.
-- paths: ["/var/log/journal"]
+- paths: {{ journal_paths | to_json }}
 
   # The number of seconds to wait before trying to read again from journals.
   backoff: 10s