Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 24 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,31 @@ class { 'winlogbeat':
},
},
}
```

To ship files to [elasticsearch cloud](https://www.elastic.co/guide/en/beats/winlogbeat/current/configure-cloud-id.html):
```puppet
class { 'winlogbeat':
# must be 6 or above to be recognized by winlogbeat
major_version => '7',
package_ensure => '7.9.0',
cloud => {
id => 'YOUR_CLOUD_ID',
auth => 'elastic:YOUR_CLOUD_AUTH'
},
outputs => {
'elasticsearch' => {
#overridden by cloud.id and cloud.auth
'hosts' => [
'http://localhost:9200',
],
'index' => 'winlogbeat',
'cas' => [
'/etc/pki/root/ca.pem',
],
},
},
}
```

To ship log files through [logstash](https://www.elastic.co/guide/en/beats/winlogbeat/current/logstash-output.html):
Expand All @@ -73,7 +97,6 @@ class { 'winlogbeat':
},
},
}

```

[Shipper](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-shipper.html) and [logging](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-logging.html) options can be configured the same way, and are documented on the [elastic website](https://www.elastic.co/guide/en/beats/winlogbeat/current/index.html).
Expand Down
1 change: 1 addition & 0 deletions manifests/config.pp
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
'metrics' => $winlogbeat::metrics,
'event_logs' => $winlogbeat::event_logs_final,
},
'cloud' => $winlogbeat::cloud,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not seeing this section in the template
or do we have general treatment for that?

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

either way, having a test that proves this code correct would be useful.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see what you mean. Adding the erb template changes to set a cloud.id and cloud.auth and will get it working with my elastic.co version today

'output' => $winlogbeat::outputs,
'shipper' => $winlogbeat::shipper,
'logging' => $winlogbeat::logging,
Expand Down
2 changes: 2 additions & 0 deletions manifests/init.pp
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
# @param service_ensure [String] The ensure parameter on the winlogbeat service (default: running)
# @param service_enable [String] The enable parameter on the winlogbeat service (default: true)
# @param registry_file [String] The registry file used to store positions, absolute or relative to working directory (default .winlogbeat.yml)
# @param cloud [Hash] Will be converted to YAML to create the optional cloud section of the winlogbeat config
# @param outputs [Hash] Will be converted to YAML for the required outputs section of the winlogbeat config
# @param shipper [Hash] Will be converted to YAML to create the optional shipper section of the winlogbeat config
# @param logging [Hash] Will be converted to YAML to create the optional logging section of the winlogbeat config
Expand All @@ -34,6 +35,7 @@
$service_provider = $winlogbeat::params::service_provider,
$registry_file = $winlogbeat::params::registry_file,
$config_file = $winlogbeat::params::config_file,
$cloud = $winlogbeat::params::cloud,
$outputs = $winlogbeat::params::outputs,
$shipper = $winlogbeat::params::shipper,
$logging = $winlogbeat::params::logging,
Expand Down
1 change: 1 addition & 0 deletions manifests/params.pp
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
$max_procs = undef
$fields = {}
$fields_under_root = false
$cloud = {}
$outputs = {}
$shipper = {}
$logging = {}
Expand Down
11 changes: 11 additions & 0 deletions templates/winlogbeat5.yml.erb
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,17 @@ max_procs: <%= @winlogbeat_config['max_procs'] %>
#- add_cloud_metadata:
#

#================================ Cloud ======================================
<%- if @winlogbeat_config['cloud'] != nil -%>
cloud:
<%- if @winlogbeat_config['cloud']['id'] != nil -%>
id: "<%= @winlogbeat_config['cloud']['id'] %>"
<%- end -%>
<%- if @winlogbeat_config['cloud']['auth'] != nil -%>
auth: "<%= @winlogbeat_config['cloud']['auth'] %>"
<%- end -%>
<%- end -%>

#================================ Outputs ======================================

<%- if @winlogbeat_config['output']['elasticsearch'] != nil -%>
Expand Down