Skip to content

Instantly share code, notes, and snippets.

@BlackMaria
Last active February 13, 2019 15:56
Show Gist options
  • Save BlackMaria/1ba349ae555859b61f878db0ca0d3471 to your computer and use it in GitHub Desktop.
Save BlackMaria/1ba349ae555859b61f878db0ca0d3471 to your computer and use it in GitHub Desktop.
notes on how i installed my beats on my home network. I should make an ansible module for that
#!/bin/bash
VERSION=6.3.0
ELK_HOST=10.1.202.107
ROOT=${PWD}
BEATS_ROOT=/opt/beats
mkdir -p ${BEATS_ROOT} BEATS
cd BEATS
for beat in filebeat packetbeat metricbeat auditbeat
do
if [ ! -d ${BEATS_ROOT}/${beat} ] ; then
echo makeing ${BEATS_ROOT}/${beat}
mkdir ${ROOT}/${beat}-${VERSION}
cd ${ROOT}/${beat}-${VERSION}
[ -f ${beat}-${VERSION}-linux-x86_64.tar.gz ] || wget https://artifacts.elastic.co/downloads/beats/${beat}/${beat}-${VERSION}-linux-x86_64.tar.gz
tar -xzvf ${beat}-${VERSION}-linux-x86_64.tar.gz
mkdir -p ${BEATS_ROOT}/${beat}
rsync -aP ${beat}-${VERSION}-linux-x86_64/ ${BEATS_ROOT}/${beat}/
cat <<EOF >> ${BEATS_ROOT}/${beat}/${beat}.yml
#
# ${BEATS_ROOT}/${beat}/${beat}.yml
#
setup.kibana:
#output.elasticsearch:
# hosts: ["http://${ELK_HOST}:9200"]
#setup.kibana:
# host: "http://${ELK_HOST}:5601"
output.logstash:
hosts: ["${ELK_HOST}:5044"]
EOF
cd ${BEATS_ROOT}/${beat}/
if [ "${beat}" == filebeat ] || [ "${beat}" == metricbeat ]; then
./${beat} modules enable system
./${beat} modules enable docker
fi
./${beat} setup
cat <<EOF > /etc/systemd/system/${beat}.service
[Unit]
Description=${beat}
After=network.target auditd.service
ConditionPathExists=!${BEATS_ROOT}/${beat}/${beat}/not_to_be_run
[Service]
EnvironmentFile=-/etc/default/${beat}
WorkingDirectory=${BEATS_ROOT}/${beat}/
ExecStart=${BEATS_ROOT}/${beat}/${beat} -e
ExecReload=/bin/kill -HUP
KillMode=process
Restart=on-failure
RestartPreventExitStatus=255
Type=notify
[Install]
WantedBy=multi-user.target
Alias=${beat}.service
EOF
fi
systemctl stop ${beat}
systemctl disable ${beat}
done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment