87 lines
2.4 KiB
YAML
87 lines
2.4 KiB
YAML
# Filebeat config for shipping mail-stack logs to ELK.
|
|
#
|
|
# Stack we ship:
|
|
# - Flask gunicorn access/error → /var/log/mail-flask.log
|
|
# - Dramatiq worker → /var/log/mail-dramatiq.log
|
|
# - Backup cron → /var/log/mail-backup.log
|
|
# - DMS (Postfix/Dovecot) → docker logs / docker-mailserver-1 host log
|
|
#
|
|
# Output: Logstash on ${ELK_HOST}:5044 (Beats input, lumberjack).
|
|
# Override via env vars in /etc/default/filebeat or via templating.
|
|
|
|
filebeat.inputs:
|
|
- type: filestream
|
|
id: mail-flask
|
|
paths:
|
|
- /var/log/mail-flask.log
|
|
parsers:
|
|
- ndjson:
|
|
target: ""
|
|
overwrite_keys: true
|
|
ignore_decoding_error: true
|
|
fields:
|
|
service: mail-flask
|
|
environment: ${ENV:dev}
|
|
fields_under_root: true
|
|
|
|
- type: filestream
|
|
id: mail-dramatiq
|
|
paths:
|
|
- /var/log/mail-dramatiq.log
|
|
fields:
|
|
service: mail-dramatiq
|
|
environment: ${ENV:dev}
|
|
fields_under_root: true
|
|
|
|
- type: filestream
|
|
id: mail-backup
|
|
paths:
|
|
- /var/log/mail-backup.log
|
|
fields:
|
|
service: mail-backup
|
|
environment: ${ENV:dev}
|
|
fields_under_root: true
|
|
|
|
# Postfix + Dovecot through host file written by DMS volume mount.
|
|
- type: filestream
|
|
id: dms-mail
|
|
paths:
|
|
- /home/deeily/mail/docker/dms-data/logs/mail.log
|
|
- /home/deeily/mail/docker/dms-data/logs/mail.err
|
|
fields:
|
|
service: dms
|
|
environment: ${ENV:dev}
|
|
fields_under_root: true
|
|
|
|
processors:
|
|
- add_host_metadata: ~
|
|
- add_fields:
|
|
target: ""
|
|
fields:
|
|
host_role: mail-server
|
|
- drop_fields:
|
|
fields: ["agent.ephemeral_id", "ecs.version", "input.type", "log.flags"]
|
|
ignore_missing: true
|
|
|
|
# ── Output ─────────────────────────────────────────────────────────────────
|
|
|
|
output.logstash:
|
|
hosts: ["${ELK_HOST:logstash.internal}:${ELK_PORT:5044}"]
|
|
# ssl.enabled: true # uncomment if Logstash uses TLS
|
|
# ssl.certificate_authorities: ["/etc/filebeat/ca.crt"]
|
|
|
|
# Альтернатива: прямо в Elasticsearch
|
|
# output.elasticsearch:
|
|
# hosts: ["https://${ELK_HOST:elastic.internal}:9200"]
|
|
# username: "${ELASTIC_USER}"
|
|
# password: "${ELASTIC_PASSWORD}"
|
|
# ssl.verification_mode: full
|
|
|
|
logging.level: info
|
|
logging.to_files: true
|
|
logging.files:
|
|
path: /var/log/filebeat
|
|
name: filebeat
|
|
keepfiles: 5
|
|
permissions: 0640
|