ISTI-ansible-roles
/
ansible-role-elasticsearch
4
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Import the old role.

This commit is contained in:
Andrea Dell'Amico 2020-08-20 18:25:25 +02:00
parent 0b7ac4d820
commit 7505c4642d
18 changed files with 794 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
README.md
View File

@ -1,31 +1,75 @@
Role Name Role Name
========= =========
A brief description of the role goes here. A role that installs the free components of Elasticsearch and, optionally, Kibana. <https://www.elastic.co>
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables Role Variables
-------------- --------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. The most important variables are listed below:
``` yaml
elasticsearch_install: True
elasticsearch_major_version: 7
elasticsearch_minor_version: 9
elasticsearch_patch_version: 0
elasticsearch_kibana_install: False
elasticsearch_kibana_enabled: True
elasticsearch_kibana_proxy: False
elasticsearch_kibana_nginx_proxy: True
elasticsearch_kibana_http_port: 5601
elasticsearch_kibana_bind_ip: 127.0.0.1
elasticsearch_kibana_serverpath: ''
elasticsearch_kibana_servername: '{{ ansible_fqdn }}'
elasticsearch_kibana_elasticsearch_url: 'http://localhost:9200'
elasticsearch_kibana_preserve_host: 'false'
elasticsearch_kibana_ssl_enabled: False
elasticsearch_kibana_rundir: /run/kibana
elasticsearch_package_state: 'present'
elasticsearch_cluster_name: 'Elasticsearch Cluster'
elasticsearch_enabled: True
elasticsearch_http_port: 9200
elasticsearch_transport_min_port: 9300
elasticsearch_transport_max_port: 9400
elasticsearch_data_dir: /var/lib/elasticsearch
elasticsearch_log_dir: /var/log/elasticsearch
elasticsearch_bind_ip: 0.0.0.0
elasticsearch_discovery_host_list: '["127.0.0.1", "[::1]"]'
elasticsearch_define_majority_of_nodes: True
elasticsearch_majority_of_nodes: 1
elasticsearch_bootstrap_known_masters:
- '{{ ansible_fqdn }}'
elasticsearch_real_cluster: False
elasticsearch_recover_after_nodes: 3
elasticsearch_max_local_storage_nodes: 1
elasticsearch_destructive_requires_name: 'true'
elasticsearch_define_heap_size: False
elasticsearch_heap_size: 2g
elasticsearch_additional_java_opts: '-server -Djava.awt.headless=true -Dfile.encoding=UTF-8'
elasticsearch_additional_conf:
- { name: 'search.max_buckets', value: '65535'}
elasticsearch_max_open_files: 65535
elasticsearch_cluster_routing_allocation_disk_threshold_enabled: 'true'
elasticsearch_cluster_routing_allocation_disk_watermark_low: '85%'
elasticsearch_cluster_routing_allocation_disk_watermark_high: '90%'
# Compatibility with kernels <= 3.5. Set to False if you are using a newer kernel
elasticsearch_disable_bootstrap_syscall_filter: True
# elasticsearch 5+ not supported yet, so set it to False when installing 5.x
elasticsearch_hq_install: False
elasticsearch_hq_plugin:
- { name: 'royrusso/elasticsearch-HQ', state: 'present' }
```
Dependencies Dependencies
------------ ------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. * openjdk
* nginx (as reverse proxy for Kibana)
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License License
------- -------
@ -35,4 +79,4 @@ EUPL-1.2
Author Information Author Information
------------------ ------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed). Andrea Dell'Amico, <andrea.dellamico@isti.cnr.it>

55
defaults/main.yml
View File

@ -1,2 +1,55 @@
--- ---
# defaults file for ansible-role-template elasticsearch_install: True
elasticsearch_major_version: 7
elasticsearch_minor_version: 9
elasticsearch_patch_version: 0
elasticsearch_kibana_install: False
elasticsearch_kibana_enabled: True
elasticsearch_kibana_proxy: False
elasticsearch_kibana_nginx_proxy: True
elasticsearch_kibana_http_port: 5601
elasticsearch_kibana_bind_ip: 127.0.0.1
elasticsearch_kibana_serverpath: ''
elasticsearch_kibana_servername: '{{ ansible_fqdn }}'
elasticsearch_kibana_elasticsearch_url: 'http://localhost:9200'
elasticsearch_kibana_preserve_host: 'false'
elasticsearch_kibana_ssl_enabled: False
elasticsearch_kibana_rundir: /run/kibana
elasticsearch_package_state: 'present'
elasticsearch_cluster_name: 'Elasticsearch Cluster'
elasticsearch_enabled: True
elasticsearch_http_port: 9200
elasticsearch_transport_min_port: 9300
elasticsearch_transport_max_port: 9400
elasticsearch_data_dir: /var/lib/elasticsearch
elasticsearch_log_dir: /var/log/elasticsearch
elasticsearch_bind_ip: 0.0.0.0
elasticsearch_discovery_host_list: '["127.0.0.1", "[::1]"]'
elasticsearch_define_majority_of_nodes: True
elasticsearch_majority_of_nodes: 1
elasticsearch_bootstrap_known_masters:
- '{{ ansible_fqdn }}'
elasticsearch_real_cluster: False
elasticsearch_recover_after_nodes: 3
elasticsearch_max_local_storage_nodes: 1
elasticsearch_destructive_requires_name: 'true'
elasticsearch_define_heap_size: False
elasticsearch_heap_size: 2g
elasticsearch_additional_java_opts: '-server -Djava.awt.headless=true -Dfile.encoding=UTF-8'
elasticsearch_additional_conf:
- { name: 'search.max_buckets', value: '65535'}
elasticsearch_max_open_files: 65535
elasticsearch_cluster_routing_allocation_disk_threshold_enabled: 'true'
elasticsearch_cluster_routing_allocation_disk_watermark_low: '85%'
elasticsearch_cluster_routing_allocation_disk_watermark_high: '90%'
# Compatibility with kernels <= 3.5. Set to False if you are using a newer kernel
elasticsearch_disable_bootstrap_syscall_filter: True
# elasticsearch 5+ not supported yet, so set it to False when installing 5.x
elasticsearch_hq_install: False
elasticsearch_hq_plugin:
- { name: 'royrusso/elasticsearch-HQ', state: 'present' }

11
handlers/main.yml
View File

@ -1,2 +1,11 @@
--- ---
# handlers file for ansible-role-template - name: Restart elasticsearch
service: name=elasticsearch state=restarted enabled=yes
when: elasticsearch_enabled | bool
ignore_errors: True
- name: Restart kibana
service: name=kibana state=restarted enabled=yes
when: elasticsearch_kibana_enabled | bool

67
meta/main.yml
View File

@ -1,61 +1,32 @@
galaxy_info: galaxy_info:
author: your name author: Andrea Dell'Amico
description: your description description: Systems Architect
company: ISTI-CNR company: ISTI-CNR
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
issue_tracker_url: https://redmine-s2i2s.isti.cnr.it/projects/provisioning issue_tracker_url: https://redmine-s2i2s.isti.cnr.it/projects/provisioning
# Some suggested licenses: license: EUPL 1.2+
# - BSD (default)
# - MIT
# - GPLv2
# - GPLv3
# - Apache
# - CC-BY
license: EUPL-1.2
min_ansible_version: 2.8 min_ansible_version: 2.8
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
# Optionally specify the branch Galaxy will use when accessing the GitHub
# repo for this role. During role install, if no tags are available,
# Galaxy will use this branch. During import Galaxy will access files on
# this branch. If Travis integration is configured, only notifications for this
# branch will be accepted. Otherwise, in all cases, the repo's default branch
# (usually master) will be used.
#github_branch:
#
# Provide a list of supported platforms, and for each platform a list of versions.
# If you don't wish to enumerate all versions for a particular platform, use 'all'.
# To view available platforms and versions (or releases), visit: # To view available platforms and versions (or releases), visit:
# https://galaxy.ansible.com/api/v1/platforms/ # https://galaxy.ansible.com/api/v1/platforms/
# #
# platforms: platforms:
# - name: Fedora - name: Ubuntu
# versions: versions:
# - all - bionic
# - 25
# - name: SomePlatform
# versions:
# - all
# - 1.0
# - 7
# - 99.99
galaxy_tags: [] galaxy_tags:
# List tags for your role here, one per line. A tag is a keyword that describes - users
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.
dependencies:
- src: git+https://gitea-s2i2s.isti.cnr.it/ISTI-ansible-roles/ansible-role-openjdk.git
version: master
name: openjdk
state: latest
- src: git+https://gitea-s2i2s.isti.cnr.it/ISTI-ansible-roles/ansible-role-nginx.git
version: master
name: nginx
state: latest
when: elasticsearch_kibana_nginx_proxy

27
tasks/elasticsearch.yml Normal file
View File

@ -0,0 +1,27 @@
---
- name: Elasticsearch installation
block:
- name: Install the elasticsearch deb packages
apt: name='{{ elasticsearch_packages }}' state={{ elasticsearch_package_state }} update_cache=yes cache_valid_time=1800
- name: Install the elasticsearch startup default
template: src=elasticsearch-default.j2 dest=/etc/default/elasticsearch owner=root group=elasticsearch mode=0640
register: elasticsearch_default
notify: Restart elasticsearch
when: ansible_distribution_file_variety == "Debian"
tags: [ 'ELK', 'elasticsearch', 'elk' ]
- name: Elasticsearch configuration
block:
- name: Install the elasticsearch JVM options
template: src=jvm.options.j2 dest=/etc/elasticsearch/jvm.options owner=root group=elasticsearch mode=0640
register: elasticsearch_jvm_opts
notify: Restart elasticsearch
- name: Install the elasticsearch configuration
template: src=elasticsearch.yml.j2 dest=/etc/elasticsearch/elasticsearch.yml owner=root group=elasticsearch mode=0640
register: elasticsearch_configuration
notify: Restart elasticsearch
tags: [ 'ELK', 'elasticsearch', 'elk', 'elasticsearch_conf' ]

16
tasks/elasticsearch_plugins.yml Normal file
View File

@ -0,0 +1,16 @@
---
- block:
- name: Manage a list of elasticsearch plugins
elasticsearch_plugin: name="{{ item.name }}" state={{ item.state }} plugin_bin={{ elasticsearch_plugin_bin }} url={{ item.url|default(omit) }} version={{ item.version|default(omit) }}
with_items: '{{ elasticsearch_plugins | default ([]) }}'
- name: Install the elasticsearch HQ plugin
elasticsearch_plugin: name="{{ item.name }}" state={{ item.state }} plugin_bin={{ elasticsearch_plugin_bin }} url={{ item.url|default(omit) }} version={{ item.version|default(omit) }}
with_items: '{{ elasticsearch_hq_plugin | default ([]) }}'
when:
- elasticsearch_major_version <= 2
- elasticsearch_hq_install
when: elasticsearch_plugins is defined
tags: [ 'elasticsearch', 'es_plugins' ]

11
tasks/elasticsearch_service.yml Normal file
View File

@ -0,0 +1,11 @@
---
- name: Ensure that elasticsearch is enabled and running
service: name=elasticsearch state=started enabled=yes
when: elasticsearch_enabled | bool
tags: [ 'ELK', 'elasticsearch', 'elk' ]
- name: Ensure that elasticsearch is disabled and stopped
service: name=elasticsearch state=stopped enabled=no
when: not elasticsearch_enabled | bool
tags: [ 'ELK', 'elasticsearch', 'elk' ]

10
tasks/elk_repo.yml Normal file
View File

@ -0,0 +1,10 @@
---
- name: ELK repository
block:
- name: Install the elasticsearch repo key
apt_key: url={{ elasticsearch_repo_key }} state=present
- name: Install the elasticsearch deb repository
apt_repository: repo='{{ elasticsearch_repo }}' state=present update_cache=yes
tags: [ 'ELK', 'elasticsearch', 'elk' ]

58
tasks/kibana.yml Normal file
View File

@ -0,0 +1,58 @@
---
- name: Kibana x509 certificate management
block:
- name: Create the acme hooks directory if it does not yet exist
file: dest={{ letsencrypt_acme_sh_services_scripts_dir }} state=directory owner=root group=root
- name: Create the kibana pki subdir
file: dest={{ pki_dir }}/kibana state=directory owner=root group=kibana mode=0750
- name: Check if the global certificate private key exists
stat: path={{ letsencrypt_acme_certs_dir }}/privkey
register: kibana_privkey
- name: Check if the kibana certificate private key exists under the pki directory
stat: path={{ pki_dir }}/kibana/privkey
register: kibana_pki_privkey
- name: Copy the private key into the expected place if it is not already there
copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest={{ pki_dir }}/kibana/privkey remote_src=yes owner=root group=kibana mode=0440
when:
- kibana_privkey.stat.exists
- not kibana_pki_privkey.stat.exists
- name: Install the kibana hook for letsencrypt
template: src=kibana-letsencrypt-hook.sh.j2 dest=/usr/lib/acme/hooks/kibana owner=root group=root mode=0550
when:
- elasticsearch_kibana_ssl_enabled | bool
- letsencrypt_acme_install is defined and letsencrypt_acme_install | bool
tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana' ]
- name: Kibana installation
block:
- name: Install the Kibana packages
apt: name='{{ elasticsearch_kibana_packages }}' state={{ elasticsearch_package_state }} update_cache=yes cache_valid_time=1800
when: ansible_distribution_file_variety == "Debian"
tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana' ]
- name: Kibana service
block:
- name: Install the kibana systemd configuration to manage the rundir directory
template: src=kibana_rundir.conf.j2 dest=/usr/lib/tmpfiles.d/kibana.conf owner=root group=root mode=0644
register: reconfigure_systemd
- name: Reload the systemd configuration
systemd: daemon_reload=yes
tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana', 'kibana_service' ]
- name: Kibana configuration
block:
- name: Install the Kibana configuration
template: src=kibana.yml.j2 dest=/etc/kibana/kibana.yml owner=root group=kibana mode=0640
register: kibana_configuration
notify: Restart kibana
tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana', 'kibana_conf' ]

11
tasks/kibana_service.yml Normal file
View File

@ -0,0 +1,11 @@
---
- name: Ensure that kibana is enabled and running
service: name=kibana state=started enabled=yes
when: elasticsearch_kibana_enabled | bool
tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana' ]
- name: Ensure that kibana is disabled and stopped
service: name=kibana state=stopped enabled=no
when: not elasticsearch_kibana_enabled | bool
tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana' ]

13
tasks/main.yml
View File

@ -1,2 +1,13 @@
--- ---
# tasks file for ansible-role-template - import_tasks: elk_repo.yml
- import_tasks: elasticsearch.yml
when: elasticsearch_install | bool
- import_tasks: elasticsearch_plugins.yml
when: elasticsearch_install | bool
- import_tasks: elasticsearch_service.yml
when: elasticsearch_install | bool
- import_tasks: kibana.yml
when: elasticsearch_kibana_install | bool
- import_tasks: kibana_service.yml
when: elasticsearch_kibana_install | bool

76
templates/elasticsearch-default.j2 Normal file
View File

@ -0,0 +1,76 @@
################################
# Elasticsearch
################################
# Elasticsearch home directory
#ES_HOME=/usr/share/elasticsearch
# Elasticsearch configuration directory
#CONF_DIR=/etc/elasticsearch
# Elasticsearch data directory
DATA_DIR={{ elasticsearch_data_dir }}
# Elasticsearch logs directory
LOG_DIR={{ elasticsearch_log_dir }}
# Elasticsearch PID directory
#PID_DIR=/var/run/elasticsearch
{% if elasticsearch_major_version <= 2 %}
# Set ES_HEAP_SIZE to 50% of available RAM, but no more than 31g
ES_HEAP_SIZE={{ elasticsearch_heap_size }}
# Heap new generation
#ES_HEAP_NEWSIZE=
# Maximum direct memory
#ES_DIRECT_SIZE=
# Additional Java OPTS
ES_JAVA_OPTS="{{ elasticsearch_additional_java_opts }}"
{% endif %}
# Configure restart on package upgrade (true, every other setting will lead to not restarting)
#ES_RESTART_ON_UPGRADE=true
# Path to the GC log file
#ES_GC_LOG_FILE=/var/log/elasticsearch/gc.log
################################
# Elasticsearch service
################################
# SysV init.d
#
# When executing the init script, this user will be used to run the elasticsearch service.
# The default value is 'elasticsearch' and is declared in the init.d file.
# Note that this setting is only used by the init script. If changed, make sure that
# the configured user can read and write into the data, work, plugins and log directories.
# For systemd service, the user is usually configured in file /usr/lib/systemd/system/elasticsearch.service
{% if elasticsearch_major_version < 6 %}
ES_USER=elasticsearch
ES_GROUP=elasticsearch
{% endif %}
# The number of seconds to wait before checking if Elasticsearch started successfully as a daemon process
ES_STARTUP_SLEEP_TIME=5
################################
# System properties
################################
# Specifies the maximum file descriptor number that can be opened by this process
# When using Systemd, this setting is ignored and the LimitNOFILE defined in
# /usr/lib/systemd/system/elasticsearch.service takes precedence
MAX_OPEN_FILES={{ elasticsearch_max_open_files }}
# The maximum number of bytes of memory that may be locked into RAM
# Set to "unlimited" if you use the 'bootstrap.mlockall: true' option
# in elasticsearch.yml (ES_HEAP_SIZE must also be set).
# When using Systemd, the LimitMEMLOCK property must be set
# in /usr/lib/systemd/system/elasticsearch.service
MAX_LOCKED_MEMORY=unlimited
# Maximum number of VMA (Virtual Memory Areas) a process can own
# When using Systemd, this setting is ignored and the 'vm.max_map_count'
# property is set at boot time in /usr/lib/sysctl.d/elasticsearch.conf
#MAX_MAP_COUNT=262144

140
templates/elasticsearch.yml.j2 Normal file
View File

@ -0,0 +1,140 @@
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please see the documentation for further information on configuration options:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration.html>
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: {{ elasticsearch_cluster_name }}
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: {{ ansible_fqdn }}
{% if elasticsearch_kibana_proxy %}
# This node is bein used by kibana as proxy to a cluster
node.master: false
node.data: false
node.ingest: false
{% endif %}
{% if elasticsearch_major_version >= 7 %}
cluster.initial_master_nodes:
{% for n in elasticsearch_bootstrap_known_masters %}
- {{ n }}
{% endfor %}
{% endif %}
#
# Add custom attributes to the node:
#
# node.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: {{ elasticsearch_data_dir }}
#
# Path to log files:
#
path.logs: {{ elasticsearch_log_dir }}
#
{% if elasticsearch_major_version <= 2 %}
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
bootstrap.mlockall: true
#
# Make sure that the `ES_HEAP_SIZE` environment variable is set to about half the memory
# available on the system and that the owner of the process is allowed to use this limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
{% endif %}
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
{% if elasticsearch_kibana_proxy %}
network.host: localhost
{% else %}
network.host: {{ elasticsearch_bind_ip }}
{% endif %}
#
# Set a custom port for HTTP:
#
http.port: {{ elasticsearch_http_port }}
# by default transport.host refers to network.host
transport.host: {{ elasticsearch_bind_ip }}
{% if elasticsearch_major_version >= 6 %}
transport.tcp.port: {{ elasticsearch_transport_min_port }}-{{ elasticsearch_transport_max_port }}
{% endif %}
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html>
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.zen.ping.unicast.hosts: {{ elasticsearch_discovery_host_list }}
#
{% if elasticsearch_define_majority_of_nodes %}
# Prevent the "split brain" by configuring the majority of nodes (total number of nodes / 2 + 1):
#
discovery.zen.minimum_master_nodes: {{ elasticsearch_majority_of_nodes }}
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery.html>
#
{% if elasticsearch_real_cluster %}
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
gateway.recover_after_nodes: {{ elasticsearch_recover_after_nodes }}
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-gateway.html>
#
{% endif %}
{% endif %}
# ---------------------------------- Various -----------------------------------
#
# Disable starting multiple nodes on a single system:
#
node.max_local_storage_nodes: {{ elasticsearch_max_local_storage_nodes }}
#
# Require explicit names when deleting indices:
#
action.destructive_requires_name: {{ elasticsearch_destructive_requires_name }}
#
cluster.routing.allocation.disk.threshold_enabled: {{ elasticsearch_cluster_routing_allocation_disk_threshold_enabled }}
cluster.routing.allocation.disk.watermark.low: {{ elasticsearch_cluster_routing_allocation_disk_watermark_low }}
cluster.routing.allocation.disk.watermark.high: {{ elasticsearch_cluster_routing_allocation_disk_watermark_high }}
{% for conf in elasticsearch_additional_conf %}
{{ conf.name }}: {{ conf.value }}
{% endfor %}
{% if elasticsearch_disable_bootstrap_syscall_filter %}
# When using an old kernel
bootstrap.system_call_filter: false
{% endif %}

129
templates/jvm.options.j2 Normal file
View File

@ -0,0 +1,129 @@
## JVM configuration
################################################################
## IMPORTANT: JVM heap size
################################################################
##
## You should always set the min and max JVM heap
## size to the same value. For example, to set
## the heap to 4 GB, set:
##
## -Xms4g
## -Xmx4g
##
## See https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html
## for more information
##
################################################################
# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space
-Xms{{ elasticsearch_heap_size }}
-Xmx{{ elasticsearch_heap_size }}
################################################################
## Expert settings
################################################################
##
## All settings below this section are considered
## expert settings. Don't tamper with them unless
## you understand what you are doing
##
################################################################
## GC configuration
-XX:+UseConcMarkSweepGC
-XX:CMSInitiatingOccupancyFraction=75
-XX:+UseCMSInitiatingOccupancyOnly
## optimizations
# disable calls to System#gc
-XX:+DisableExplicitGC
# pre-touch memory pages used by the JVM during initialization
-XX:+AlwaysPreTouch
## basic
# force the server VM
-server
# set to headless, just in case
-Djava.awt.headless=true
# ensure UTF-8 encoding by default (e.g. filenames)
-Dfile.encoding=UTF-8
# use our provided JNA always versus the system one
-Djna.nosys=true
# turn off a JDK optimization that throws away stack traces for common
# exceptions because stack traces are important for debugging
-XX:-OmitStackTraceInFastThrow
# flag to explicitly tell Netty to not use unsafe
-Dio.netty.noUnsafe=true
-Dio.netty.noKeySetOptimization=true
-Dio.netty.recycler.maxCapacityPerThread=0
-Dlog4j.shutdownHookEnabled=false
-Dlog4j2.disable.jmx=true
{% if elasticsearch_major_version >= 6 %}
-Djava.io.tmpdir=${ES_TMPDIR}
{% endif %}
## heap dumps
# generate a heap dump when an allocation from the Java heap fails
# heap dumps are created in the working directory of the JVM
-XX:+HeapDumpOnOutOfMemoryError
# specify an alternative path for heap dumps
# ensure the directory exists and has sufficient space
#-XX:HeapDumpPath=${heap.dump.path}
## GC logging
#-XX:+PrintGCDetails
#-XX:+PrintGCTimeStamps
#-XX:+PrintGCDateStamps
#-XX:+PrintClassHistogram
#-XX:+PrintTenuringDistribution
#-XX:+PrintGCApplicationStoppedTime
# log GC status to a file with time stamps
# ensure the directory exists
#-Xloggc:${loggc}
# Elasticsearch 5.0.0 will throw an exception on unquoted field names in JSON.
# If documents were already indexed with unquoted fields in a previous version
# of Elasticsearch, some operations may throw errors.
#
# WARNING: This option will be removed in Elasticsearch 6.0.0 and is provided
# only for migration purposes.
#-Delasticsearch.json.allow_unquoted_field_names=true
# specify an alternative path for heap dumps
# ensure the directory exists and has sufficient space
-XX:HeapDumpPath={{ elasticsearch_data_dir }}
## JDK 8 GC logging
8:-XX:+PrintGCDetails
8:-XX:+PrintGCDateStamps
8:-XX:+PrintTenuringDistribution
8:-XX:+PrintGCApplicationStoppedTime
8:-Xloggc:/var/log/elasticsearch/gc.log
8:-XX:+UseGCLogFileRotation
8:-XX:NumberOfGCLogFiles=32
8:-XX:GCLogFileSize=64m
# JDK 9+ GC logging
9-:-Xlog:gc*,gc+age=trace,safepoint:file=/var/log/elasticsearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m
# due to internationalization enhancements in JDK 9 Elasticsearch need to set the provider to COMPAT otherwise
# time/date parsing will break in an incompatible way for some date patterns and locals
9-:-Djava.locale.providers=COMPAT

38
templates/kibana-letsencrypt-hook.sh.j2 Normal file
View File

@ -0,0 +1,38 @@
#!/bin/bash
H_NAME=$( hostname -f )
LE_SERVICES_SCRIPT_DIR=/usr/lib/acme/hooks
LE_CERTS_DIR="/var/lib/acme/live/$H_NAME"
LE_LOG_DIR=/var/log/letsencrypt
KIBANA_CERTDIR=/etc/pki/kibana
KIBANA_KEYFILE="$KIBANA_CERTDIR/privkey"
DATE=$( date )
[ ! -d $KIBANA_CERTDIR ] && mkdir -p $KIBANA_CERTDIR
[ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
echo "$DATE" >> $LE_LOG_DIR/kibana.log
{% if letsencrypt_acme_install %}
LE_ENV_FILE=/etc/default/letsencrypt
{% endif %}
{% if letsencrypt_acme_sh_install %}
LE_ENV_FILE=/etc/default/acme_sh_request_env
{% endif %}
if [ -f "$LE_ENV_FILE" ] ; then
. "$LE_ENV_FILE"
else
echo "No letsencrypt default file" >> $LE_LOG_DIR/kibana.log
fi
echo "Building the new certificate file" >> $LE_LOG_DIR/kibana.log
cp -f ${LE_CERTS_DIR}/privkey ${KIBANA_KEYFILE}
chmod 440 ${KIBANA_KEYFILE}
chgrp kibana ${KIBANA_KEYFILE}
echo "Reload the kibana service" >> $LE_LOG_DIR/kibana.log
systemctl restart kibana >> $LE_LOG_DIR/kibana.log 2>&1
echo "Done." >> $LE_LOG_DIR/kibana.log
exit 0

108
templates/kibana.yml.j2 Normal file
View File

@ -0,0 +1,108 @@
# Kibana is served by a back end server. This setting specifies the port to use.
server.port: {{ elasticsearch_kibana_http_port }}
# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "{{ elasticsearch_kibana_bind_ip }}"
# Enables you to specify a path to mount Kibana at if you are running behind a proxy. This only affects
# the URLs generated by Kibana, your proxy is expected to remove the basePath value before forwarding requests
# to Kibana. This setting cannot end in a slash.
server.basePath: "{{ elasticsearch_kibana_serverpath }}"
# The maximum payload size in bytes for incoming server requests.
#server.maxPayloadBytes: 1048576
# The Kibana server's name. This is used for display purposes.
server.name: "{{ elasticsearch_kibana_servername }}"
# The URL of the Elasticsearch instance to use for all your queries.
elasticsearch.url: "{{ elasticsearch_kibana_elasticsearch_url }}"
# When this setting's value is true Kibana uses the hostname specified in the server.host
# setting. When the value of this setting is false, Kibana uses the hostname of the host
# that connects to this Kibana instance.
elasticsearch.preserveHost: {{ elasticsearch_kibana_preserve_host }}
# Kibana uses an index in Elasticsearch to store saved searches, visualizations and
# dashboards. Kibana creates a new index if the index doesn't already exist.
#kibana.index: ".kibana"
# The default application to load.
#kibana.defaultAppId: "discover"
# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
#elasticsearch.username: "user"
#elasticsearch.password: "pass"
{% if letsencrypt_acme_install is defined and letsencrypt_acme_install %}
{% if elasticsearch_kibana_ssl_enabled %}
# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
# These settings enable SSL for outgoing requests from the Kibana server to the browser.
server.ssl.enabled: true
server.ssl.certificate: {{ letsencrypt_acme_certs_dir }}/fullchain
server.ssl.key: {{ pki_dir }}/kibana/privkey
{% endif %}
{% endif %}
# Optional settings that provide the paths to the PEM-format SSL certificate and key files.
# These files validate that your Elasticsearch backend uses the same key files.
#elasticsearch.ssl.certificate: /path/to/your/client.crt
#elasticsearch.ssl.key: /path/to/your/client.key
# Optional setting that enables you to specify a path to the PEM file for the certificate
# authority for your Elasticsearch instance.
#elasticsearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]
# To disregard the validity of SSL certificates, change this setting's value to 'none'.
#elasticsearch.ssl.verificationMode: full
# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of
# the elasticsearch.requestTimeout setting.
#elasticsearch.pingTimeout: 1500
# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value
# must be a positive integer.
#elasticsearch.requestTimeout: 30000
# List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side
# headers, set this value to [] (an empty list).
#elasticsearch.requestHeadersWhitelist: [ authorization ]
# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten
# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.
#elasticsearch.customHeaders: {}
# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.
#elasticsearch.shardTimeout: 0
# Time in milliseconds to wait for Elasticsearch at Kibana startup before retrying.
#elasticsearch.startupTimeout: 5000
# Specifies the path where Kibana creates the process ID file.
pid.file: {{ elasticsearch_kibana_rundir }}/kibana.pid
# Enables you specify a file where Kibana stores log output.
#logging.dest: stdout
# Set the value of this setting to true to suppress all logging output.
#logging.silent: false
# Set the value of this setting to true to suppress all logging output other than error messages.
#logging.quiet: false
# Set the value of this setting to true to log all events, including system usage information
# and all requests.
#logging.verbose: false
# Set the interval in milliseconds to sample system and process performance
# metrics. Minimum is 100ms. Defaults to 5000.
#ops.interval: 5000
# The default locale. This locale can be used in certain circumstances to substitute any missing
# translations.
#i18n.defaultLocale: "en"

1
templates/kibana_rundir.conf.j2 Normal file
View File

@ -0,0 +1 @@
d {{ elasticsearch_kibana_rundir }} 0775 kibana kibana

13
vars/main.yml
View File

@ -1,2 +1,13 @@
--- ---
# vars file for ansible-role-template elasticsearch_repo_key: https://packages.elastic.co/GPG-KEY-elasticsearch
elasticsearch_repo_version: '{{ elasticsearch_major_version }}.x'
elasticsearch_version: '{{ elasticsearch_major_version }}.{{ elasticsearch_minor_version }}.{{ elasticsearch_patch_version }}'
elasticsearch_repo: 'deb https://artifacts.elastic.co/packages/{{ elasticsearch_repo_version }}/apt stable main'
elasticsearch_packages:
- elasticsearch
elasticsearch_plugin_bin: /usr/share/elasticsearch/bin/elasticsearch-plugin
elasticsearch_kibana_packages:
- kibana