isavoy / chef-libbeat

Chef cookbook that installs/Configures Elastic libbeat, based on https://github.com/vkhatri/chef-filebeat

chef-libbeat

libbeat Cookbook\n================\n\n \n\nThis is a [Chef] cookbook to manage [libbeat].\n\n\n>> For Production environment, always prefer the most recent release.\n\n\n## Most Recent Release\n\n\ncookbook 'libbeat', '~> 0.2.5'\n\n\n## From Git\n\n\ncookbook 'libbeat', github: 'isavoy/chef-libbeat'\n\n\n## Repository\n\n\nhttps://github.com/isavoy/chef-libbeat\n\n\n## Supported OS\n\nThis cookbook was tested on Windows, Amazon & Ubuntu Linux and expected to work on other RHEL platforms.\n\n## Major Changes\n\n### v0.2.x\n- Removed default output configuration attributes for elasticsearch, logstash and file\n- Removed attributed default['libbeat']['enable_localhost_output'] as default output attributes are disabled\n\n## Cookbook Dependency\n\n- windows\n- powershell\n- apt\n- yum\n\n\n## Recipes\n\n- libbeat::default - default recipe (use it for run_list)\n\n- libbeat::install_windows - install libbeat for windows platform\n\n- libbeat::install_package - install libbeat package for linux platform\n\n- libbeat::config - configure libbeat\n\n\n## Core Attributes\n\n\n* default['libbeat']['version'] (default: 1.0.0): libbeat version\n\n* default['libbeat']['package_url'] (default: auto): package url for windows installation\n\n* default['libbeat']['conf_dir'] (default: /etc/libbeat): libbeat yaml configuration file directory\n\n* default['libbeat']['conf_file'] (default: /etc/libbeat/libbeat.yml): libbeat configuration file\n\n* default['libbeat']['notify_restart'] (default: true): whether to restart libbeat service on configuration file change\n\n* default['libbeat']['disable_service'] (default: false): whether to stop and disable libbeat service\n\n* default['libbeat']['prospectors_dir'] (default: /etc/libbeat/conf.d): prospectors configuration file directory\n\n* default['libbeat']['prospectors'] (default: {}): prospectors configuration file\n\n## Configuration File libbeat.yml Attributes\n\n* default['libbeat']['config']['libbeat']['prospectors'] (default: []): libbeat interface device name\n\n* default['libbeat']['config']['libbeat']['registry_file'] (default: /var/lib/libbeat/registry): libbeat services to capture packets\n\n* default['libbeat']['config']['libbeat']['config_dir'] (default: node['libbeat']['prospectors_dir']): libbeat prospectors configuration files folder\n\n\n* default['libbeat']['config']['output'] (default: {}): configure elasticsearch. logstash, file etc. output\n\nFor more attribute info, visit below links:\n\nhttps://github.com/elastic/libbeat/blob/master/etc/libbeat.yml\n\n\n## libbeat YUM/APT Repository Attributes\n\n* default['libbeat']['yum']['description'] (default: ``): beats yum reporitory attribute\n\n* default['libbeat']['yum']['gpgcheck'] (default: `true`): beats yum reporitory attribute\n\n* `default['libbeat']['yum']['enabled']` (default: `true`): beats yum reporitory attribute\n\n* `default['libbeat']['yum']['baseurl']` (default: `https://packages.elastic.co/beats/yum/el/$basearch`): beatsyum reporitory attribute\n\n* `default['libbeat']['yum']['gpgkey']` (default: `https://packages.elasticsearch.org/GPG-KEY-elasticsearch`): beats yum reporitory attribute\n\n* `default['libbeat']['yum']['action']` (default: `:create`): beats yum reporitory attribute\n\n\n* `default['libbeat']['apt']['description']` (default: `calculated`): beats apt reporitory attribute\n\n* `default['libbeat']['apt']['components']` (default: `['stable', 'main']`): beats apt reporitory attribute\n\n* `default['libbeat']['apt']['uri']` (default: `https://packages.elastic.co/beats/apt`): beats apt reporitory attribute\n\n* `default['libbeat']['apt']['key']` (default: `http://packages.elasticsearch.org/GPG-KEY-elasticsearch`): beats apt reporitory attribute\n\n* `default['libbeat']['apt']['action']` (default: `:add`): libbeat apt reporitory attribute\n\n\n\n## How to Add libbeat Prospectors via Node Attribute\n\nIndividual propspectors configuration file can be added using attribute `default['libbeat']['prospectors']`. Each prospector configuration will\nbe created as a different yaml file under `default['libbeat']['prospector_dir']` with prefix `prospector-`\n\n\n \"default_attributes\": {\n \"libbeat\": {\n \"prospectors\": {\n \"system_logs\": {\n \"libbeat\": {\n \"prospectors\": [\n {\n \"paths\": [\n \"/var/log/messages\",\n \"/var/log/syslog\"\n ],\n \"type\": \"log\",\n \"fields\": {\n \"type\": \"system_logs\"\n }\n }\n ]\n }\n },\n \"secure_logs\": {\n \"libbeat\": {\n \"prospectors\": [\n {\n \"paths\": [\n \"/var/log/secure\",\n \"/var/log/auth.log\"\n ],\n \"type\": \"log\",\n \"fields\": {\n \"type\": \"secure_logs\"\n }\n }\n ]\n }\n },\n \"apache_logs\": {\n \"libbeat\": {\n \"prospectors\": [\n {\n \"paths\": [\n \"/var/log/apache/*.log\"\n ],\n \"type\": \"log\",\n \"ignore_older\": \"24h\",\n \"scan_frequency\": \"15s\",\n \"harvester_buffer_size\": 16384,\n \"fields\": {\n \"type\": \"apache_logs\"\n }\n }\n ]\n }\n }\n }\n }\n }\n\n\n\n\nAbove configuration will create three different prospector files - `prospector-system_logs.yml, prospector-secure_logs.yml and prospector-apache_logs.yml`\n\n## Contributing\n\n1. Fork the repository on Github\n2. Create a named feature branch (like `add_component_x`)\n3. Write your change\n4. Write tests for your change (if applicable)\n5. Run the tests (`rake & rake knife`), ensuring they all pass\n6. Write new resource/attribute description to `README.md`\n7. Write description about changes to PR\n8. Submit a Pull Request using Github\n\n\n## Copyright & License\n\nAuthors:: Virender Khatri and [Contributors]\n\n

\nLicensed under the Apache License, Version 2.0 (the "License");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an "AS IS" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n

\n\n\n[Chef]: https://www.chef.io/\n[libbeat]: https://www.elastic.co/products/beats/libbeat\n[Contributors]: https://github.com/isavoy/chef-libbeat/graphs/contributors\n