modify systemd filebeat service file

[freibuis]

Currently installing filebeat 7.x onto a system with systemd the defaults interfer with filebeat.yml file

[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/products/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]

Environment="BEAT_LOG_OPTS=-e"
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat/filebeat.yml"
Environment="BEAT_PATH_OPTS=-path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat"
ExecStart=/usr/share/filebeat/bin/filebeat $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always

[Install]
WantedBy=multi-user.target

the line

Environment="BEAT_LOG_OPTS=-e"

with -e flag defaults logging to syslog and will ignore any logging configs

example:

logging:
  level: debug
  to_syslog: false
  metrics:
    enabled: false
  to_files: true
  files:
    path: "/var/log/filebeat"
    name: filebeat
    keepfiles: '7'
    permissions: '0644'

so the question.
should this module control the filebeat systemd service file or should this be done externally?

[freibuis]

I am currently doing this to get around the logging opts flag

  file_line { 'disable_filebeat_sys_logging':
    ensure            => absent,
    path              => '/lib/systemd/system/filebeat.service',
    match             => '^Environment="BEAT_LOG_OPTS=',
    match_for_absence => true,
    notify            => Class['filebeat::service'],
  }

its dirty. I think the filebeat systemd service file should be managed via this module, to be honest.

[pcfens]

It looks like the beats project is tracking the issue too (elastic/beats#12024). In elastic/beats#12577 they suggest that this is the suggested behavior so they documented it.

Luckily elastic documents a good way to override systemd changes that we'd want to use.

Do you have any suggestions about what kind of customizations should be supported in the module vs. when someone should manage it themselves?

[freibuis]

filebeat documentaion mentions a drop in file
running-with-systemd.html#_customize_systemd_unit_for_filebeat

maybe something like this

if $logging != {} {
  # do systemd customization here
} else {
  # make sure default setting is used here
}

on each filebeat upgrade, the systemd file will be replaced which means we should not edit the systemd service file but
maintain a /etc/systemd/system/filebeat.service.d/logging.conf file

which would have contents

Environment="BEAT_LOG_OPTS="

then add information to the doc's wit the logging to say default on systemd systems is to log into syslog. from version 7.0+

I will test this and let you know if this works.. I can create a PR also if needed

[freibuis]

adding the systemd config file /etc/systemd/system/filebeat.service.d/logging.conf

[Service]
Environment="BEAT_LOG_OPTS="

works. I will see what I can do about a pr

[freibuis]

create a pull request #223

[pcfens]

I'm closing this since it was fixed in #223