Ansible實例：filebeat配置管理

項目roles結構

各組件yml文件內容

• files

  存放上傳文件的目錄.

  • filebeat.service

    [Unit]
    Description=Starts and stops a single filebeat instance on this system
    After=network-online.target
    
    [Service]
    Type=simple
    WorkingDirectory=/var/tmp
    EnvironmentFile=-/etc/local_ip.env
    ExecStart=/usr/local/filebeat-5.3.3/filebeat  -c /usr/local/filebeat-5.3.3/filebeat.yml
    ExecReload=/bin/kill -HUP $MAINPID
    Restart=on-failure
    KillMode=process
    RestartSec=32s
    MemoryLimit=500M
    StandardOutput=null
    
    [Install]
    WantedBy=multi-user.target
    

  • filebeat.yml

    filebeat.prospectors:
    - type: log
      paths:
      	- /var/log/*/*/*timelinereader*.log
      	  multiline.pattern: '^[2-9][0-9][0-9][0-9].[0-2][0-9].[0-3][0-9].[0-2][0-9]:[0-5][0-9]:[0-5][0-9]'
    	  multiline.negate: true
    	  multiline.match: after
    	  fields_under_root: true
    	  ignore_older: 24h
    	  close_inactive: 5m
    	  scan_frequency: 1s
    	  clean_inactive: 72h
    	  tags: ["actcpservice"]
    setup.template.settings:
    	index.number_of_shards: 5
    output.elasticsearch:
    	hosts: ["http://xx.xx.xx.xx:9200"]
    	index: "ac-%{+yyyy.MM.dd}"
    setup.template:
    	name: 'ac'
    	pattern: 'ac-*'
    	enabled: false
    path:
    	data: /usr/local/filebeat-5.3.3/data
    	logs: /var/log/beats
    

  • start_filebeat.sh

    #!/bin/bash
    
    systemctl daemon-reload
    systemctl start filebeat
    

• handlers

  一般用於notify觸發事件，比如：配置文件更改需要重啓應用

  • main.yml

    ---
    - name: restart filebeat
      service: 
      	name: filebeat
      	state: restarted
    

• tasks

  實際的一個個task任務.

  • copy.yml

    ---
    - name: copy filebeat.yml
      copy: src=filebeat.yml dest={{ base_dir }}/filebeat-5.3.3 mode=0755
      notify:
      - restart filebeat
    - name: copy filebeat.service
      copy: src=filebeat.service dest=/usr/lib/systemd/system mode=0644
    

  • main.yml

    ---
    - import_tasks: wget_filebeat.yaml
    - import_tasks: copy.yaml
      tags:
      - copy_file
    - import_tasks: start_filebeat.yaml
      tags:
      - start_filebeat
    

  • start_filebeat.yml

    ---
    - name: start filebeat
      script: start_filebeat.sh
    

  • wget_filebeat.yml

    ---
    - name: wget filebeat
      get_url:
      	url: https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.3.3-linux-x86_64.tar.gz
      	dest: "{{ base_dir }}"
      ignore_errors: True
      register: result
    - name: copy filebeat.tar
      copy:
      	src: filebeat-5.3.3-linux-x86_64.tar.gz
      	dest: "{{ base_dir }}"
      	mode: 0755
      	when: result|failed
    - name: jieya
      unarchive: 
      	src: "{{ base_dir }}/filebeat-5.3.3-linux-x86_64.tar.gz"
    	dest: "{{ base_dir }}"
    	copy: no
    - name: mv filebeat-5.3.3-linux-x86_64 filebeat-5.3.3
      command: mv {{ base_dir }}/filebeat-5.3.3-linux-x86_64 {{ base_dir }}/filebeat-5.3.3
    

• templates

  模板文件存放的目錄

  • elasticsearch_exporter.j2

    {
    	"services": [
    		{
        		"name": "elasticsearch_exporter", 
        		"tags": [
        		], 
        		"checks": [
            		{
                		"interval": "30s", 
                		"timeout": "1s", 
                		"tcp": "{{ inventory_hostname }}:9114"
            		}
        		], 
        		"enable_tag_override": false, 
        		"id": "elasticsearch_exporter", 
        		"port": 9114
    		} 
    	]
    }
    

• vars

  存放變量的目錄.

  • main.yml

    remote_user: opsadmin
    sudo: yes
    base_dir: /usr/local