Ansible role which installs and configures Graylog log management.
- Ansible 2.0 or higher.
- MongoDB
- Elasticsearch
- Nginx
- Tested on Ubuntu 14.04 / Debian 7 / Centos 7
- You need at least 4GB of memory to run Graylog
- Here is an example of a playbook targeting Vagrant box(es):
---
- hosts: all
remote_user: vagrant
become: True
vars:
es_instance_name: 'graylog'
es_scripts: False
es_templates: False
es_version_lock: False
es_heap_size: 1g
es_config: {
node.name: "graylog",
cluster.name: "graylog",
discovery.zen.ping.unicast.hosts: "localhost:9301",
http.port: 9200,
transport.tcp.port: 9300,
network.host: 0.0.0.0,
node.data: true,
node.master: true,
bootstrap.mlockall: false,
discovery.zen.ping.multicast.enabled: false
}
graylog_web_endpoint_uri: 'http://127.0.0.1:9000/api/'
roles:
- role: 'Graylog2.graylog-ansible-role'
tags: graylog
- Create a playbook file with that content, e.g.
your_playbook.yml
- Fetch this role
ansible-galaxy install -n -p ./roles Graylog2.graylog-ansible-role
- Install role's dependencies
ansible-galaxy install -r roles/Graylog2.graylog-ansible-role/requirements.yml -p ./roles
- Apply the playbook to a Vagrant box
ansible-playbook your_playbook.yml -i "127.0.0.1:2222,"
- Login to Graylog by opening
http://127.0.0.1:9000
in your browser. Default username and password isadmin
# Basic server settings
graylog_is_master: 'True'
graylog_password_secret: '2jueVqZpwLLjaWxV' # generate with: pwgen -s 96 1
graylog_root_password_sha2: '8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918' # generate with: echo -n yourpassword | shasum -a 256
# Elasticsearch message retention
graylog_elasticsearch_max_docs_per_index: 20000000
graylog_elasticsearch_max_number_of_indices: 20
graylog_elasticsearch_shards: 4
graylog_elasticsearch_replicas: 0
graylog_rest_listen_uri: 'http://0.0.0.0:9000/api/'
graylog_web_listen_uri: 'http://0.0.0.0:9000/'
graylog_web_endpoint_uri: 'http://127.0.0.1:9000/api/'
Take a look into defaults/main.yml
to get an overview of all configuration parameters.
- Set up
roles_path = ./roles
inansible.cfg
([defaults]
block) - Install role
ansible-galaxy install Graylog2.graylog-ansible-role
- Install role's dependencies
ansible-galaxy install -r roles/Graylog2.graylog-ansible-role/requirements.yml
- Set up playbook (see example below):
# your_playbook.yml
---
- hosts: server
become: True
vars:
es_instance_name: 'graylog'
es_scripts: False
es_templates: False
es_version_lock: False
es_heap_size: 1g
es_config: {
node.name: "graylog",
cluster.name: "graylog",
discovery.zen.ping.unicast.hosts: "localhost:9301",
http.port: 9200,
transport.tcp.port: 9300,
network.host: 0.0.0.0,
node.data: true,
node.master: true,
bootstrap.mlockall: false,
discovery.zen.ping.multicast.enabled: false
}
graylog_web_endpoint_uri: 'http://127.0.0.1:9000/api/'
nginx_sites:
graylog:
- listen 80
- server_name graylog
- location / {
proxy_pass http://localhost:9000/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass_request_headers on;
proxy_connect_timeout 150;
proxy_send_timeout 100;
proxy_read_timeout 100;
proxy_buffers 4 32k;
client_max_body_size 8m;
client_body_buffer_size 128k; }
roles:
- role: 'Graylog2.graylog-ansible-role'
tags: graylog
- Run the playbook with
ansible-playbook -i inventory_file your_playbook.yml
- Login to Graylog by opening
http://<host IP>
in your browser, default username and password isadmin
One can test the role on the supported distributions (see meta/main.yml
for the complete list),
by using the Docker images provided.
Example for Debian Wheezy and Ubuntu Trusty:
$ cd graylog-ansible-role
$ docker build -t graylog-ansible-role-wheezy -f tests/support/wheezy.Dockerfile tests/support
$ docker run -it -v $PWD:/role graylog-ansible-role-wheezy
For Trusty, just replace wheezy
with trusty
in the above commands.
Example for CentOS 7:
Due to how systemd
works with Docker, the following approach is suggested:
$ cd graylog-ansible-role
$ docker build -t graylog-ansible-role-centos7 -f tests/support/centos7.Dockerfile tests/support
$ docker run -d --privileged -it -v /sys/fs/cgroup:/sys/fs/cgroup:ro -v $PWD:/role:ro graylog-ansible-role-centos7 /usr/sbin/init
$ DOCKER_CONTAINER_ID=$(docker ps | grep centos | awk '{print $1}')
$ docker logs $DOCKER_CONTAINER_ID
$ docker exec -it $DOCKER_CONTAINER_ID /bin/bash -xec "bash -x run-tests.sh"
$ docker ps -a
$ docker stop $DOCKER_CONTAINER_ID
$ docker rm -v $DOCKER_CONTAINER_ID
Author: Marius Sturm ([email protected]) and contributors
License: Apache 2.0