garutilorenzo / ansible-collection-elk

The Elastic stack (ELK) powered by Ansible

Install and configure the ELK stack

Install and configure the ELK stack:

• elasticsearch
• logstash
• kibana

Elastic Beats:

• filebeat
• metricbeat
• heartbeath

Requirements

Install ansible, ipaddr and netaddr:

pip install -r requirements.txt

Roles documentation

You can refer to the README.md file in each role directory:

• elasticsearch
• kibana
• logstash
• beats

you can also explore all roles variables here

Using this collection

Install from GitHub

ansible-galaxy collection install git+https://github.com/garutilorenzo/ansible-collection-elk

Examples

How to use this Ansible collection

Vagrant

To test this collection you can use Vagrant and Virtualbox to bring up a example infrastructure. Once you have downloaded this repo use Vagrant to start the virtual machines:

vagrant up

In the Vagrantfile you can inject your public ssh key directly in the authorized_keys of the vagrant user. You have to change the CHANGE_ME placeholder in the Vagrantfile. You can also adjust the number of the vm deployed by changing the NNODES variable (Default: 6)

Tutorial

Full tutorial available here

TODO

• Add cleanup step
• Add upgrade step

ansible-collection-elk's Issues

Update the playbooks to v8.12.2

Buongiorno Lorenzo,

I am trying to use this wonderful project to install a new bare metal Elastic cluster.
I am a little crazy and I tried to install the version 8.12.2

At first I encountered some issues I could solve with some vars.yml tuning.
Now I see that some setups are getting misaligned with the Elastic recommendations.

Examples:

• Kibana is not installable with SSL and https
• the Kibana user is now deprecated in favor of kybana_system
• Beats is not trivial to install and make it work on my setup
• the passwords and users for the additional modules are not on specific names, but always use the same elasticsearch_username variable

How is it possible to fully remove the ELK deployment from a machine?

elasticsearch.yml.j2 config error

Following error appears when elasticsearch_https_enabled: no:

[2023-04-25T10:49:30,358][ERROR][o.e.b.Elasticsearch      ] [es-0] fatal exception while booting Elasticsearch
org.elasticsearch.ElasticsearchSecurityException: invalid configuration for xpack.security.http.ssl - [xpack.security.http.ssl.enabled] is not set, but the following settings have been configured in elasticsearch.yml : [xpack.security.http.ssl.keystore.secure_password]

Possible fix for elasticsearch.yml.j2:

...
{% if elasticsearch_https_enabled %}
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: {{ elasticsearch_certs_dir }}/http.p12
{% else %}
xpack.security.http.ssl.enabled: false
{% endif %}

Amazing work

Not An issue as such but want to say great work on this, this has helped me out loads.