elastic/ansible-beats

conditionals in output config

NanoPish opened this issue · 3 comments

To have multiple output indices, like in https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/2

We use this syntax:

output.elasticsearch:
  hosts: ["elastic1:9200", "elastic2:9200"]
  indices:
    - index: "filebeat-%{[agent.version]}-apache-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "apache"
    - default: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"

I have been struggling hard to make ansible to_nice_yaml produce such output. I wonder if it is even possible. What is hard is you need to use an array to obtain the - index: XXXX part, but also you need the when to be indented at the same level...

How do you guys make this work ?

elasticsearch.indices:
    - index: "MY_INDEX"
    when.equals: "event.module: haproxy"

is invalid yaml

 elasticsearch.indices:
  - index: "MY_INDEX"
  when.equals: "event.module: haproxy"

is valid yaml
but is invalid filebeat.yml :

elasticsearch.indices:
  - index: MY_INDEX
  when.equals: 'event.module: haproxy'

NVM this works:

output_conf:
  elasticsearch:
    hosts:
      "{{ els }}:9200"
    username: ""
    password: ""
    indices:
      - index: "filebeat-%{[agent.version]}-haproxy-%{+yyyy.MM.dd}"
        when.equals:
          event.module: "haproxy"