Role Detail


Filebeat for Linux.
Type Ansible
Minimum Ansible Version 2.0
Installation $ ansible-galaxy install geerlingguy.filebeat
Last Commit 2017-08-01 04:02:04 AM UTC
Last Imported 2017-10-22 16:53:04 PM UTC
Version History
Version Release Date
1.3.0 2017-03-16 22:20:10 PM
1.2.0 2017-01-27 21:58:09 PM
1.1.0 2017-01-26 16:26:04 PM
1.0.1 2016-09-14 16:13:04 PM
1.0.0 2016-09-12 19:56:07 PM
0.9.1 2016-09-04 04:39:04 AM
0.9.0 2016-09-04 04:28:04 AM
Supported Platforms
Platform Version
Debian jessie
EL 6
EL 7
Ubuntu precise
Ubuntu trusty
Ubuntu xenial
Last 10 Imports
Completed Status
2017-10-22 16:53:04 PM UTC SUCCESS
2017-10-20 10:52:10 AM UTC SUCCESS
2017-08-30 11:08:11 AM UTC SUCCESS
2017-08-08 10:07:10 AM UTC SUCCESS
2017-08-01 04:38:04 AM UTC SUCCESS
2017-08-01 04:36:04 AM UTC SUCCESS
2017-08-01 04:26:04 AM UTC SUCCESS
2017-07-27 18:39:06 PM UTC SUCCESS
2017-06-23 10:34:10 AM UTC SUCCESS
2017-04-02 04:41:04 AM UTC SUCCESS

Ansible Role: Filebeat for ELK Stack

Build Status

An Ansible Role that installs Filebeat on RedHat/CentOS or Debian/Ubuntu.



Role Variables

Available variables are listed below, along with default values (see defaults/main.yml):

filebeat_create_config: true

Whether to create the Filebeat configuration file and handle the copying of SSL key and cert for filebeat. If you prefer to create a configuration file yourself you can set this to false.

  - input_type: log
      - "/var/log/*.log"

Prospectors that will be listed in the prospectors section of the Filebeat configuration. Read through the Filebeat Prospectors configuration guide for more options.

filebeat_output_elasticsearch_enabled: false
  - "localhost:9200"

Whether to enable Elasticsearch output, and which hosts to send output to.

filebeat_output_logstash_enabled: true
  - "localhost:5000"

Whether to enable Logstash output, and which hosts to send output to.

filebeat_enable_logging: false 
filebeat_log_level: warning
filebeat_log_dir: /var/log/filebeat
filebeat_log_filename: filebeat.log

Filebeat logging.

filebeat_ssl_dir: /etc/pki/logstash

The path where certificates and keyfiles will be stored.

filebeat_ssl_certificate_file: ""
filebeat_ssl_key_file: ""

Local paths to the SSL certificate and key files, which will be copied into the filebeat_ssl_dir.

For utmost security, you should use your own valid certificate and keyfile, and update the filebeat_ssl_* variables in your playbook to use your certificate.

To generate a self-signed certificate/key pair, you can use use the command:

$ sudo openssl req -x509 -batch -nodes -days 3650 -newkey rsa:2048 -keyout filebeat.key -out filebeat.crt

Note that filebeat and logstash may not work correctly with self-signed certificates unless you also have the full chain of trust (including the Certificate Authority for your self-signed cert) added on your server. See:

filebeat_ssl_insecure: "false"

Set this to "true" to allow the use of self-signed certificates (when a CA isn't available).



Example Playbook

- hosts: logs
    - geerlingguy.elasticsearch
    - geerlingguy.logstash
    - geerlingguy.filebeat



Author Information

This role was created in 2016 by Jeff Geerling, author of Ansible for DevOps.