VAdamec

curl -XPUT http://localhost:9200/_template/logstash_ossec -d '{
"template" : "*ossec*",
"settings": {
"number_of_shards": 12,
"number_of_replicas": 1
},
"mappings": {
"ossec": {
"_all": {
"enabled": false

VAdamec

input {
  zeromq {
    type     => 'zmq'
    topology => 'pushpull'
    address  => 'tcp://*:5556'
    mode     => 'server'
  }
}

output {

VAdamec

{
  "title": "OSSEC",
  "services": {
    "query": {
      "idQueue": [
        0,
        1
      ],
      "list": {
        "2": {

VAdamec

#
# https://gist.githubusercontent.com/samdoran/
# https://forge.puppetlabs.com/elasticsearch/elasticsearch - cluster split prod/dev/stg/... by cluster name <project>-<cluster_name>-....
#
---
- name: Elasticsearch rolling upgrade
  hosts: elk
  serial: 1
  sudo: yes
  gather_facts: true

VAdamec

#
# ansible-playbook -i hosts download_errata.yml --vault-password-file=/etc/.ipassword -s -U root
#
---
- name: Update ERRATAS if any new package
  hosts: pulpservers
  sudo: yes
  gather_facts: yes
  vars_files:
    - pass.yml

VAdamec

    - name: Set Hipchat MSG
      set_fact:
        REPORTMSG: "LIVE UPDATE + ERRATA SYNC {{ timestamp.stdout }} - CENTOS Update"
        COLORMSG: "green"

    - name: Send notification to HipChat
      include: hipchat-notification.yml
      tags: notify

    - name: Ensure git

VAdamec

#!/usr/bin/python

import optparse
from pprint import pprint
import sys
# from pysphere.vi_vapp import VIVApp
from pysphere import VIServer, VITask, MORTypes, VIProperty
from pysphere.resources import VimService_services as VI

# CFG

VAdamec

# notifications/elk.j2
{"when_it_happened": "{{ elktimestamp.stdout }}", "title": "System", "tags": ["{{ tags }}"], "description": "{{ notification_msg }}"}

# notifications/elk-anotation.yml
  - name: Timestamp for ELK
    local_action: command date -u +"%Y-%m-%dT%H:%M:%S.%3NZ"
    register: elktimestamp

  - template:
      src: notifications/elk.j2

VAdamec

curl -XDELETE  "http://localhost:9200/events/"
 
curl -XPUT localhost:9200/events -H 'Content-Type: application/json' -d '{
    "settings": {
        "index.number_of_shards": 2,
        "index.number_of_replicas": 0
    },
    "mappings": {
        "prod": {
            "properties": {

VAdamec

<source>
 type tail
 format json
 path /var/ossec/logs/alerts/alerts.json
 pos_file /var/log/td-agent/ossec_log_json.pos
 tag ossec.process
</source>

<match ossec.process>
  type parser