CentOS7x_Install-Logstash-playbook.yml

---

################################################################################
#  description: Installs Logstash on CentOS7x
#  usage: ansible-playbook CentOS7x_Install-Logstash-playbook.yml --extra-vars 'HostOrGroup=YourServerOrGroupNameGoesHere ElasticsearchIP=IPAddressHere'
#  author: Ernest G. Wilson II <ErnestGWilsonII@gmail.com> (https://github.com/ernestgwilsonii)
#  license: MIT
################################################################################


# Ansible Playbook options
# REF: http://docs.ansible.com/ansible/playbooks.html
#####################################################

- name: Install Logstash on CentOS7x
  hosts: "{{ HostOrGroup|default ('FATAL ERROR --> HostOrGroup NOT SET! You must specify either a Host or a Group name!') }}"
  serial: "100%"
  gather_facts: False
  tasks:


# Install or configure repository used on the OS by yum
# REF: https://docs.ansible.com/ansible/yum_repository_module.html
##################################################################

# /etc/yum.repos.d/elasticsearch.repo
  - name: Install repository Elasticsearch
    yum_repository:
      name: elasticsearch
      description: Elasticsearch repository
      file: elasticsearch
      baseurl: https://artifacts.elastic.co/packages/5.x/yum
      enabled: yes
      gpgcheck: yes
      gpgkey: https://packages.elastic.co/GPG-KEY-elasticsearch


# Install yum packages
# REF: http://docs.ansible.com/ansible/yum_module.html
######################################################

  - name: Install logstash
    yum:
      name=logstash
      state=latest


# Restart firewalld to make sure it is running OK before changing any rules
# REF: http://docs.ansible.com/ansible/service_module.html
##########################################################

  - name: Ensure the firewalld service is enabled and re-started before changing any rules
    service:
      name=firewalld
      enabled=yes
      state=restarted


# Update the firewalld configuration
# REF: http://docs.ansible.com/ansible/firewalld_module.html
############################################################

  - name: Update firewall to allow port UDP 162 for incoming Logstash snmptrap connections
    firewalld:
      port=162/udp
      permanent=true
      immediate=yes
      state=enabled
      zone=public

  - name: Update firewall to allow port UDP 514 for incoming Logstash Syslog connections
    firewalld:
      port=514/udp
      permanent=true
      immediate=yes
      state=enabled
      zone=public

  - name: Update firewall to allow port TCP 514 for incoming Logstash Syslog connections
    firewalld:
      port=514/tcp
      permanent=true
      immediate=yes
      state=enabled
      zone=public

  - name: Update firewall to allow port TCP 5044 for incoming Logstash Beats connections
    firewalld:
      port=5044/tcp
      permanent=true
      immediate=yes
      state=enabled
      zone=public

  - name: Update firewall to allow port TCP 9600 for incoming Logstash API endpoint connections
    firewalld:
      port=9600/tcp
      permanent=true
      immediate=yes
      state=enabled
      zone=public

  - name: Update firewall to allow port TCP 9601 for incoming Logstash API endpoint connections
    firewalld:
      port=9601/tcp
      permanent=true
      immediate=yes
      state=enabled
      zone=public


# Use the template module to populate files with data
# REF: http://docs.ansible.com/ansible/template_module.html
###########################################################

# /etc/logstash/logstash.yml
  - name: Fill in the variables and copy templates/Logstash/logstash.yml.j2 to remote /etc/logstash/logstash.yml
    template:
      src=templates/Logstash/logstash.yml.j2
      dest=/etc/logstash/logstash.yml
      owner=root
      group=root
      mode=0644

# /etc/logstash/conf.d/logstash.conf
  - name: Fill in the variables and copy templates/Logstash/logstash.conf.j2 to remote /etc/logstash/conf.d/logstash.conf
    template:
      src=templates/Logstash/logstash.conf.j2
      dest=/etc/logstash/conf.d/logstash.conf
      owner=root
      group=root
      mode=0644


# Enable and start Logstash
# REF: http://docs.ansible.com/ansible/service_module.html
##########################################################

  - name: Enable and start the logstash service
    service:
      name=logstash
      enabled=yes
      state=restarted
      # Note: Verify Logstash via SSH command line:
      # systemctl status logstash
      # service logstash status
      # cat /var/log/logstash/logstash.log
      # cat /etc/logstash/conf.d/logstash.conf
      # cat /var/log/logstash/logstash.err
      # cat /var/log/logstash/logstash.stdout
      # cat /etc/logrotate.d/logstash
      # cat /etc/logstash/logstash.yml
      # cat /var/log/logstash/logstash-plain.log
      # ss -ntlup | grep 5044 # Beats port
      # ss -ntlup | grep 9600 # Logstash API endpoint port