New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Icinga module to Filebeat #3904

Merged
merged 3 commits into from Apr 21, 2017

Conversation

Projects
None yet
5 participants
@bobapple
Contributor

bobapple commented Apr 4, 2017

This commit introduces the Icinga module to Filebeat. It is capable
of processing the main, debug and startup log of the Icinga daemon.

@elasticmachine

This comment has been minimized.

elasticmachine commented Apr 4, 2017

Jenkins standing by to test this. If you aren't a maintainer, you can ignore this comment. Someone with commit access, please review this and clear it for Jenkins to run.

1 similar comment
@elasticmachine

This comment has been minimized.

elasticmachine commented Apr 4, 2017

Jenkins standing by to test this. If you aren't a maintainer, you can ignore this comment. Someone with commit access, please review this and clear it for Jenkins to run.

@ruflin ruflin requested a review from tsg Apr 4, 2017

@ruflin

This comment has been minimized.

Collaborator

ruflin commented Apr 12, 2017

@bobapple Thans a lot for the contribution and sorry for the late reply. We try to provide feedback soon. Could you rebase this one on master and also check the failing tests?

@bobapple

This comment has been minimized.

Contributor

bobapple commented Apr 12, 2017

@ruflin no worries. I rebased on master and fixed one of my test logs. The Travis CI tests on TARGETS=-C filebeat testsuit are happy now.

However, tests with TARGETS=check are still failing and I believe this is caused by some missing settings in filebeat.full.yaml:

diff --git a/filebeat/filebeat.full.yml b/filebeat/filebeat.full.yml
index c91a8f3..e3fcfa6 100644
--- a/filebeat/filebeat.full.yml
+++ b/filebeat/filebeat.full.yml
@@ -59,6 +59,15 @@ filebeat.modules:
 #------------------------------- Auditd Module -------------------------------
 #- module: auditd
   #log:
+    #enabled: true
+
+    # Set custom paths for the log files. If left empty,
+    # Filebeat will choose the paths depending on your OS.
+    #var.paths:
+
+    # Prospector configuration (advanced). Any prospector configuration option
+    # can be added under this section.
+    #prospector:
 
 #------------------------------- Icinga Module -------------------------------
 #- module: icinga
git update-index --refresh
filebeat/filebeat.full.yml: needs update
make: *** [check] Error 1

I am not sure tho, maybe you can give me a hint

@tsg

This comment has been minimized.

Collaborator

tsg commented Apr 12, 2017

@bobapple Running make update in the filebeat folder should fix that. You modified the correct files (the ones under the module directory), but you need a make update to modify the top level filebeat.full.yml.

@tsg

This comment has been minimized.

Collaborator

tsg commented Apr 13, 2017

Do you happen to also have some Kibana dashboards created? It would be nice to include at least a simple dashboard with the module, so people get a good starting point. Let me know if you need help with saving the dashboards.

}],
"on_failure" : [{
"set" : {
"field" : "error",

This comment has been minimized.

@tsg

tsg Apr 13, 2017

Collaborator

We've recently change this from error to error.message. Could you update it everywhere in this PR as well, please?

@tsg

This comment has been minimized.

Collaborator

tsg commented Apr 13, 2017

I've looked over the code and tested the new module a little bit. All looks 👍 👍

Can you review the small comments above? Also, can you add a line in the CHANGELOG.asciidoc file? Thanks!

@bobapple

This comment has been minimized.

Contributor

bobapple commented Apr 18, 2017

@tsg thank you for the feedback! I made the requested changes and added Kibana dashboards.

@ruflin

This comment has been minimized.

Collaborator

ruflin commented Apr 19, 2017

I fixed the conflict in the changelog.

@monicasarbu

This comment has been minimized.

Contributor

monicasarbu commented Apr 20, 2017

@bobapple Can you please run make update and commit the changes? It should add the Icinga changes in docs/modules/icinga.asciidoc and filebeat.yml. Thanks!

bobapple added some commits Apr 4, 2017

Add Icinga module to Filebeat
This commit introduces the Icinga module to Filebeat. It is capable
of processing the main, debug and startup log of the Icinga daemon.
@bobapple

This comment has been minimized.

Contributor

bobapple commented Apr 20, 2017

@monicasarbu I made the requested changes, even though the Icinga module configuration was removed from filebeat.yml after I ran make update. Tests are now running smooth again.

@monicasarbu monicasarbu merged commit 796fe56 into elastic:master Apr 21, 2017

5 checks passed

CLA Commit author has signed the CLA
Details
codecov/patch Coverage not affected when comparing 53b5f0f...89798a3
Details
codecov/project 63.95% (+<.01%) compared to 53b5f0f
Details
continuous-integration/appveyor/pr AppVeyor build succeeded
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details

athom added a commit to athom/beats that referenced this pull request Jan 25, 2018

Add Icinga module to Filebeat (elastic#3904)
* Add Icinga module to Filebeat

This commit introduces the Icinga module to Filebeat. It is capable
of processing the main, debug and startup log of the Icinga daemon.

* Update filebeat.full.yml

* Update icinga.asciidoc and filebeat.yml
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment