logstash forwarder ^#6

By chris-gondolin
stable, edge

Supports: trusty

Add to new model

Description

This charm installs and configures logstash-forwarder, a lightweight alternative to logstash-agent.

Tags:
miscellaneous ›

Overview

This charm installs and configures the logstash-forwarder package.

Usage

This is a subordinate charm, so deployment will look something like this:

juju deploy apache2
juju deploy logstash-forwarder
juju add-relation apache2 logstash-forwarder

Configuration

Configuration Essentials

To make the charm useful, you will need to configure these config variables:

servers

The name of your logstash-indexer server(s) (if the SSL certificate allows it, this can also be an IP address)

server_port

The port number used by your logstash-indexer server(s)

ssl_ca_cert

This should be a base64-encoded SSL certificate matching the cert/key pair on your logstash indexer(s)

files

The details of which log files to forward to the logstash-indexer(s). The files config variable must be valid JSON and should look something like this:

{"syslog": ["/var/log/syslog", "/var/log/*.log"], "apache": ["/var/log/apache2/*log"]}

The name (e.g. "syslog" or "apache") will be used as the logstash "type" variable.

Other Configuration Options

apt_repository

If you wish to install the logstash-forwarder package from an apt repository instead of using the included package, set this to an appropriate sources.list line

apt_repository_key

If you are using apt_repository you will need to add a matching GPG key here

config_dir

By default, the charm stores its config files in /etc/logstash-forwarder. You can change this by setting this variable

package_name

This is the name of the logstash-forwarder package (defaults to "logstash-forwarder"). If yours is called something else, you can change it here.

server_port

This is the port your logstash-indexer listens on (defaults to 5043)

ssl_cert

This is a base64-encoded SSL certificate. You probably won't need this.

ssl_key

This is the (base64-encoded) key matching ssl_cert. Again, you probably won't need this.

timeout

This sets how long the program will wait for a response from the server (in seconds) before it gives up (defaults to 15 seconds)

Troubleshooting

If you see log messages similar to "Failed to tls handshake ... because it doesn't contain any IP SANs" you are probably using an IP address in the "servers" config variable that is not valid according to the SSL certificate. The simplest option is to change to using a hostname instead.

A Note On Packages Used

The charm will install the package specified in the package_name config variable if found in the files directory. If not, it will attempt to add an apt repository using the apt_repository and apt_repository_key config variables and install from there.

There is a precompiled logstash-forwarder package in the files directory. There is also a script in scripts/build.sh that can be used to build a newer version if needed.

Logstash-forwarder Project Information

https://github.com/elasticsearch/logstash-forwarder

Configuration

application_name: (string) Operating name of the charm; logstash-forwarder
apt_repository: (string) An apt sources.list line for a repository containing the logstash-forwarder package
apt_repository_key: (string) GPG key for apt_repository
config_dir: (string) Where to store logstash-forwarder config files; /etc/logstash-forwarder
files: (string) A JSON-format hash, describing what paths to watch and their field type e.g. {"syslog": ["/var/log/syslog", "/var/log/*.log"], "apache": ["/var/log/apache2/*log"]}
package_name: (string) Filename of logstash-forwarder deb package. If this matches the name of a file in the files charm directory the package will be installed from there, otherwise it will try to install it from the repository provided by apt_repository.; logstash-forwarder_0.3.1.1_amd64.deb
server_port: (int) Logstash-indexer server port; 5043
servers: (string) Space seperated list of logstash-indexer servers
ssl_ca_cert: (string) Base64-encoded SSL CA certificate
ssl_cert: (string) Base64-encoded SSL certificate
ssl_key: (string) Base64-encoded SSL key
timeout: (int) Network timeout in seconds; 15