b21034c4b8
The Elasticsearch endpoints in use by logstash are currently hardcoded to localhost in both the logstash monitoring config and the default logstash pipeline template. This commit allows this to be configured, such that (multiple) remote endpoints can be specified for the case that logstash is not co-located with elasticsearch. The default behaviour is unchanged. Change-Id: Id871f201168ff882a5b37677747c3484f908298f
105 lines
4.3 KiB
YAML
105 lines
4.3 KiB
YAML
---
|
|
# Copyright 2018, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
temp_dir: /var/lib/logstash/tmp
|
|
logstash_pipelines: "{{lookup('template', 'logstash-pipelines.yml.j2') }}"
|
|
logstash_elasticsearch_endpoints:
|
|
- "127.0.0.1:{{ elastic_port }}"
|
|
|
|
# Set processor cores fact
|
|
q_storage: 1
|
|
|
|
# Set logstash facts
|
|
logstash_queue_size: "{{ ((((q_storage | int) >= 2) | ternary(q_storage, 2) | int) * 1024) // ((logstash_pipelines | from_yaml) | length) }}"
|
|
elastic_log_rotate_path: "/var/log/logstash"
|
|
|
|
# Enable direct syslog input into logstash. When this is enabled syslog messages
|
|
# can be sent directly to logstash via TCP or UDP.
|
|
logstash_syslog_input_enabled: false
|
|
|
|
# The typical syslog port is 514 however that is not available to logstash
|
|
# because it's a "privledged" port. For this reason 5140 is used as the default.
|
|
# Changing this port to 514 will require overrides to the service files making
|
|
# logstash run as root (not recommended).
|
|
logstash_syslog_input_port: 5140
|
|
|
|
# Protocol used when the syslog input is enabled. Modes are "tcp" or "udp".
|
|
logstash_syslog_input_mode: udp
|
|
|
|
logstash_beat_input_port: 5044
|
|
logstash_deploy_filters: true
|
|
|
|
## Logstash config showing a complete kafka setup using SSL for authentication.
|
|
# logstash_kafka_options:
|
|
# codec: json
|
|
# topic_id: "elk_kafka"
|
|
# ssl_key_password: "{{ logstash_kafka_ssl_key_password }}"
|
|
# ssl_keystore_password: "{{ logstash_kafka_ssl_keystore_password }}"
|
|
# ssl_keystore_location: "/var/lib/logstash/{{ logstash_kafka_ssl_keystore_location | basename }}"
|
|
# ssl_truststore_location: "/var/lib/logstash/{{ logstash_kafka_ssl_truststore_location | basename }}"
|
|
# ssl_truststore_password: "{{ logstash_kafka_ssl_truststore_password }}"
|
|
# bootstrap_servers:
|
|
# - server1.local:9092
|
|
# - server2.local:9092
|
|
# - server3.local:9092
|
|
# client_id: "elk_metrics_7x"
|
|
# compression_type: "gzip"
|
|
# security_protocol: "SSL"
|
|
|
|
## The following variables are options that correspond to the
|
|
## `logstash_kafka_options` variable.
|
|
# logstash_kafka_ssl_key_password: "secrete"
|
|
# logstash_kafka_ssl_keystore_password: "secrete"
|
|
# logstash_kafka_ssl_truststore_password: "secrete"
|
|
# logstash_kafka_ssl_keystore_location: "/root/kafka/keystore.jks"
|
|
# logstash_kafka_ssl_truststore_location: "/root/kafka/truststore.jks"
|
|
|
|
## Setup servers that read events from the Smart Connector directly. This
|
|
## supports multiple entries in list format using the "host" and "port" for the
|
|
## smart connector.
|
|
# logstash_arcsight_smart_connectors:
|
|
# - host: 127.0.0.1
|
|
# port: 5000
|
|
logstash_arcsight_smart_connectors: []
|
|
|
|
## Setup servers to read events from the Eevnt Broker Stream. This
|
|
## multiple entries in list format using the "host" and "port" for the
|
|
## for the event brokers.
|
|
# logstash_arcsight_event_brokers:
|
|
# - host: 127.0.0.1
|
|
# port: 5000
|
|
logstash_arcsight_event_brokers: []
|
|
|
|
## The logstash queue type can be set to "memory" or "persisted". If the queue
|
|
## type is set to memory a ramdisk will be created limiting the in memory queue
|
|
## to 50% of the JVM heap size. When this option is undefined the playbook will
|
|
## detect the media type where the queue will exist. If the media type is
|
|
## "rotational" in memory queues will be used.
|
|
# logstash_queue_type:
|
|
|
|
# Set the logstash search heap size. If this option is undefined the value will
|
|
# be derived automatically using 1/4 of the available RAM for logstash and 1/2
|
|
# of the available RAM for elasticsearch. The value is expected to be in MiB.
|
|
# logstash_heap_size: 10240 # type `int`
|
|
|
|
# Collectd ingestion options
|
|
logstash_collectd_input_enabled: false
|
|
logstash_collectd_port: 25826
|
|
logstash_collectd_buffer_size: 1452
|
|
# Security level can be ["Sign", "Encrypt"].
|
|
logstash_collectd_security_level: Sign
|
|
# To enable security the auth file is required.
|
|
#logstash_collectd_authfile: /etc/collectd/passwd
|