21f1f28ab3
Fixes for this patchset: - split out elk-openstack-client.yml to match what's done elsewhere Fixes for patchset #11: - split out filebeat into separate role for openstack clients - update README.md to use elk-openstack-client.yml for this purpose - cleanup filebeat.yml.j2 to use correct syntax (no need for " anymore) Fixes for patchset #10: - add SELinux boolean "httpd_can_network_connect" - add libsemanage-python package dependency for booleans Fixes for patchset #9: - fix for RHEL7 clients, we need to specify remote EPEL rpm - RHEL7 clients need rpm_key module to import EPEL GPG key - switch to using uri module instead of curl for checking elasticsearch indices - add python-httplib2 dependency (needed for uri module) - use curl -XPOST instead of PUT for filebeat index template in elasticsearch Fixes from patchset #7 - remove unneeded rpm usage, switch to yum module - add logic to heapsize tuning so systems > 64G of memory will never exceed the 32G recommended heapsize - logic fix for prepopulating local logs into logstash - remove elasticsearch.yml, rpm provides this and we're not customizing it yet Fixes from patchset #6: - use yum repo Ansible module where we can - remove unecessary EPEL installation (only nginx needs it) - disable EPEL repo after installation to avoid OpenStack breakage This adds: (ELK Server) - Automated ELK stack deployment - SSL client generation - Heap size tuning (1/2 of available memory) - Firewall port additions (depending on active or not) - Supports either firewalld or iptables-services - Additional upstream Filebeat Kibana dashboards (ELK Client) - Sets up filebeat with appropriate SSL certificates - utilizes both hostnames and SubjectAltName support (for environments without DNS services). (Usage) ansible-playbook -i hosts install/elk.yml ansible-playbook -i hosts install/elk-client.yml --extra-vars 'elk_server=X.X.X.X' Change-Id: Iee29f985e0bbcdf706ad869f132d4c0f1593a6b6
115 lines
3.8 KiB
YAML
115 lines
3.8 KiB
YAML
---
|
|
#
|
|
# Install/run kibana for browbeat
|
|
#
|
|
|
|
- name: Copy kibana yum repo file
|
|
copy:
|
|
src=kibana.repo
|
|
dest=/etc/yum.repos.d/kibana.repo
|
|
owner=root
|
|
group=root
|
|
mode=0644
|
|
become: true
|
|
|
|
# We need to insert data to create an initial index, query if it exists
|
|
- name: Check elasticsearch index for content
|
|
uri:
|
|
url=http://localhost:9200/_cat/indices
|
|
method=GET
|
|
return_content=yes
|
|
register: elasticsearch_index
|
|
|
|
# Populate with our own logs
|
|
- name: Populate elasticsearch index with local logs
|
|
shell: cat /var/log/messages | /opt/logstash/bin/logstash -f /etc/logstash/conf.d/10-syslog.conf
|
|
when: "'logstash-' not in elasticsearch_index.content"
|
|
|
|
- name: Install kibana rpms
|
|
yum: name={{ item }} state=present
|
|
become: true
|
|
with_items:
|
|
- kibana
|
|
- unzip
|
|
|
|
- name: Check kibana filebeat dashboards
|
|
stat: path=/tmp/filebeat-dashboards.zip
|
|
ignore_errors: true
|
|
register: kibana_dashboards_present
|
|
|
|
- name: Copy kibana filebeat dashboards
|
|
copy:
|
|
src=filebeat-dashboards.zip
|
|
dest=/tmp/filebeat-dashboards.zip
|
|
owner=root
|
|
group=root
|
|
mode=0644
|
|
become: true
|
|
ignore_errors: true
|
|
when: kibana_dashboards_present != 0
|
|
|
|
- name: Install kibana filebeat dashboards
|
|
unarchive: src=/tmp/filebeat-dashboards.zip dest=/tmp/ copy=no
|
|
ignore_errors: true
|
|
when: kibana_dashboards_present != 0
|
|
|
|
- name: Configure kibana filebeat dashboards
|
|
shell: sh /tmp/beats-dashboards-master/load.sh -url "http://localhost:9200" -user "admin:admin"
|
|
ignore_errors: true
|
|
|
|
- name: Check kibana users
|
|
stat: path=/etc/nginx/htpasswd.users
|
|
ignore_errors: true
|
|
register: kibana_user_pwfile_exists
|
|
|
|
- name: Create kibana admin user
|
|
command: htpasswd -b -c /etc/nginx/htpasswd.users admin admin
|
|
ignore_errors: true
|
|
when: kibana_user_pwfile_exists != 0
|
|
|
|
- name: Setup kibana service
|
|
service: name=kibana state=started enabled=true
|
|
become: true
|
|
|
|
- name: Check Filebeat forwarder SSL certificate
|
|
stat: path=/etc/pki/tls/certs/filebeat-forwarder.crt
|
|
ignore_errors: true
|
|
register: filebeat_forwarder_ssl_exists
|
|
|
|
- name: Create client forwarder SSL certificate
|
|
command: openssl req -subj '/CN={{ ansible_hostname }}/' -config /etc/pki/tls/openssl_extras.cnf \
|
|
-x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout /etc/pki/tls/private/filebeat-forwarder.key \
|
|
-out /etc/pki/tls/certs/filebeat-forwarder.crt
|
|
ignore_errors: true
|
|
when: filebeat_forwarder_ssl_exists != 0
|
|
|
|
- name: Check Filebeat forwarder SSL certificate copy
|
|
stat: path=/usr/share/nginx/html/filebeat-forwarder.crt
|
|
ignore_errors: true
|
|
register: filebeat_forwarder_ssl_client_copy_exists
|
|
|
|
- name: Copy Filebeat forwarder SSL certificate
|
|
command: cp /etc/pki/tls/certs/filebeat-forwarder.crt /usr/share/nginx/html/filebeat-forwarder.crt
|
|
ignore_errors: true
|
|
when: filebeat_forwarder_ssl_client_copy_exists != 0
|
|
|
|
- name: Refresh logstash service
|
|
command: systemctl restart logstash.service
|
|
ignore_errors: true
|
|
become: true
|
|
|
|
- name: Print SSL post-setup information
|
|
debug: msg="Filebeat SSL Certificate available at http://{{ ansible_hostname }}:8080/filebeat-forwarder.crt"
|
|
|
|
- name: Print post-setup URL
|
|
debug: msg="*** ELK Services available at http://{{ ansible_hostname }}/ ***"
|
|
|
|
- name: Print index creation instructions
|
|
debug: msg="** 1) Navigate to http://{{ ansible_hostname }} and login with admin/admin, click 'create' on the green index button ***"
|
|
|
|
- name: Print filebeat openstack client setup instructions
|
|
debug: msg="** 2) Run ansible-playbook -i hosts install/elk-openstack-client.yml --extra-vars 'elk_server={{ ansible_default_ipv4.address }}' to setup OpenStack clients ***"
|
|
|
|
- name: Print filebeat client setup instructions
|
|
debug: msg="** 2) Run ansible-playbook -i hosts install/elk-client.yml --extra-vars 'elk_server={{ ansible_default_ipv4.address }}' to setup clients ***"
|