Installs the ELK stack (Elasticsearch, Logstash, and Kibana) for log aggregation and monitoring. Intended for integration with Riemann for alerting functionality.
- freedomofpress.generate-ssl-cert role
- 2GB of RAM for the logserver
- logclients to ship logs
elk_kibana_user: "kibana"
# Riemann plugin for alerting, de-dot filter for ElasticSearch v2 compatibility.
# See: https://www.elastic.co/blog/introducing-the-de_dot-filter
elk_logstash_plugins:
- logstash-output-riemann
- logstash-filter-de_dot
# Interface used for firewall restrictions and IPv4 lookups
elk_network_interface: eth0
elk_cluster_name: elk-logging
# SSL is disabled by default. Set these vars to the fullpaths to SSL
# certs you wish to use, and Nginx will force HTTPS connections.
# You must place the SSL certs there in a separate play.
elk_nginx_ssl_certificate: ""
elk_nginx_ssl_certificate_key: ""
elk_nginx_server_name: localhost
# Not safe for production use! Override to secure logins.
elk_kibana_username: kibana
elk_kibana_password: kibana
# Override to change the landing page, e.g. a custom dashboard:
# "dashboard/Your-Dashboard-Name". You must replace whitespace in
# dashboard names with hyphens, since Kibana expects it.
elk_kibana_default_app: discover
Use the role in a playbook like this:
- hosts: logserver
roles:
- role: elk
elk_kibana_username: admin
elk_kibana_password: WowWhatAStrongPassword4The role does not yet create Kibana visualizations automatically. You can however
import saved visualizations that ship with the role in files/kibana-dashboards.json.
Go to Settings -> Objects -> Import in the Kibana UI and browse to the JSON file.
This role uses Molecule and ServerSpec for testing. To use it:
pip install molecule
gem install serverspec
molecule test
You can also run selective commands:
molecule idempotence
molecule verify
See the Molecule docs for more info.
See the examples/writing-filters directory in this repo for a preconfigured development environment. Copy that directory to a server with logstash installed, or use a Vagrant testing VM.
MIT