puppet-logstash-forwarder

A puppet module for managing and configuring logstash-forwarder

https://github.com/elasticsearch/logstash-forwarder

This module is based upon https://github.com/electrical/puppet-lumberjack and https://github.com/MixMuffins/puppet-lumberjack

This updated module is in the beta stage and although it is tested, not all scenarios may be covered. Tested on CentOS 6.4 using logstash-forwarder 0.3.1

Assumptions

This module assumes that a package named logstash-forwarder can be installed on the target system. You can build an RPM for your platform by following the Packaging it instruction on logstash-forwarder wiki:

Usage

Installation, make sure service is running and will be started at boot time:

 class { 'logstash_forwarder':
   cpuprofile       => '/path/to/write/cpu/profile/to/file',
   idle_flush_time  => '5',
   log_to_syslog    => false,
   spool_size       => '1024',
   servers          => ['listof.hosts:12345', '127.0.0.1:9987'],
   ssl_ca           => '/path/to/ssl/root/certificate',
 }

Removal/decommissioning:

 class { 'logstash_forwarder':
   ensure => 'absent',
 }

Install everything but disable service(s) afterwards:

 class { 'logstash_forwarder':
   status => 'disabled',
 }

To configure file inputs:

logstash_forwarder::file { 'localhost-syslog':
    paths    => ['/var/log/messages','/var/log/secure','/var/log/*.log/'],
    fields   => { 'type' : 'syslog' }, 
}

Parameters

Default parameters have been set in the params.pp class file. Options include config file and directory, package name, install dir (used by the service(s), among others.