2e751c0772
the conversion procedure is simple: - find all things that look like options, ie calls to either `mkOption` or `lib.mkOption` that take an attrset. remember the attrset as the option - for all options, find a `description` attribute who's value is not a call to `mdDoc` or `lib.mdDoc` - textually convert the entire value of the attribute to MD with a few simple regexes (the set from mdize-module.sh) - if the change produced a change in the manual output, discard - if the change kept the manual unchanged, add some text to the description to make sure we've actually found an option. if the manual changes this time, keep the converted description this procedure converts 80% of nixos options to markdown. around 2000 options remain to be inspected, but most of those fail the "does not change the manual output check": currently the MD conversion process does not faithfully convert docbook tags like <code> and <package>, so any option using such tags will not be converted at all.
253 lines
8.3 KiB
Nix
253 lines
8.3 KiB
Nix
{ config, lib, utils, pkgs, ... }:
|
|
|
|
let
|
|
inherit (lib)
|
|
attrValues
|
|
literalExpression
|
|
mkEnableOption
|
|
mkIf
|
|
mkOption
|
|
types;
|
|
|
|
cfg = config.services.filebeat;
|
|
|
|
json = pkgs.formats.json {};
|
|
in
|
|
{
|
|
options = {
|
|
|
|
services.filebeat = {
|
|
|
|
enable = mkEnableOption "filebeat";
|
|
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = pkgs.filebeat;
|
|
defaultText = literalExpression "pkgs.filebeat";
|
|
example = literalExpression "pkgs.filebeat7";
|
|
description = lib.mdDoc ''
|
|
The filebeat package to use.
|
|
'';
|
|
};
|
|
|
|
inputs = mkOption {
|
|
description = ''
|
|
Inputs specify how Filebeat locates and processes input data.
|
|
|
|
This is like <literal>services.filebeat.settings.filebeat.inputs</literal>,
|
|
but structured as an attribute set. This has the benefit
|
|
that multiple NixOS modules can contribute settings to a
|
|
single filebeat input.
|
|
|
|
An input type can be specified multiple times by choosing a
|
|
different <literal><name></literal> for each, but setting
|
|
<xref linkend="opt-services.filebeat.inputs._name_.type"/>
|
|
to the same value.
|
|
|
|
See <link xlink:href="https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html"/>.
|
|
'';
|
|
default = {};
|
|
type = types.attrsOf (types.submodule ({ name, ... }: {
|
|
freeformType = json.type;
|
|
options = {
|
|
type = mkOption {
|
|
type = types.str;
|
|
default = name;
|
|
description = lib.mdDoc ''
|
|
The input type.
|
|
|
|
Look for the value after `type:` on
|
|
the individual input pages linked from
|
|
<https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html>.
|
|
'';
|
|
};
|
|
};
|
|
}));
|
|
example = literalExpression ''
|
|
{
|
|
journald.id = "everything"; # Only for filebeat7
|
|
log = {
|
|
enabled = true;
|
|
paths = [
|
|
"/var/log/*.log"
|
|
];
|
|
};
|
|
};
|
|
'';
|
|
};
|
|
|
|
modules = mkOption {
|
|
description = ''
|
|
Filebeat modules provide a quick way to get started
|
|
processing common log formats. They contain default
|
|
configurations, Elasticsearch ingest pipeline definitions,
|
|
and Kibana dashboards to help you implement and deploy a log
|
|
monitoring solution.
|
|
|
|
This is like <literal>services.filebeat.settings.filebeat.modules</literal>,
|
|
but structured as an attribute set. This has the benefit
|
|
that multiple NixOS modules can contribute settings to a
|
|
single filebeat module.
|
|
|
|
A module can be specified multiple times by choosing a
|
|
different <literal><name></literal> for each, but setting
|
|
<xref linkend="opt-services.filebeat.modules._name_.module"/>
|
|
to the same value.
|
|
|
|
See <link xlink:href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules.html"/>.
|
|
'';
|
|
default = {};
|
|
type = types.attrsOf (types.submodule ({ name, ... }: {
|
|
freeformType = json.type;
|
|
options = {
|
|
module = mkOption {
|
|
type = types.str;
|
|
default = name;
|
|
description = lib.mdDoc ''
|
|
The name of the module.
|
|
|
|
Look for the value after `module:` on
|
|
the individual input pages linked from
|
|
<https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules.html>.
|
|
'';
|
|
};
|
|
};
|
|
}));
|
|
example = literalExpression ''
|
|
{
|
|
nginx = {
|
|
access = {
|
|
enabled = true;
|
|
var.paths = [ "/path/to/log/nginx/access.log*" ];
|
|
};
|
|
error = {
|
|
enabled = true;
|
|
var.paths = [ "/path/to/log/nginx/error.log*" ];
|
|
};
|
|
};
|
|
};
|
|
'';
|
|
};
|
|
|
|
settings = mkOption {
|
|
type = types.submodule {
|
|
freeformType = json.type;
|
|
|
|
options = {
|
|
|
|
output.elasticsearch.hosts = mkOption {
|
|
type = with types; listOf str;
|
|
default = [ "127.0.0.1:9200" ];
|
|
example = [ "myEShost:9200" ];
|
|
description = lib.mdDoc ''
|
|
The list of Elasticsearch nodes to connect to.
|
|
|
|
The events are distributed to these nodes in round
|
|
robin order. If one node becomes unreachable, the
|
|
event is automatically sent to another node. Each
|
|
Elasticsearch node can be defined as a URL or
|
|
IP:PORT. For example:
|
|
`http://192.15.3.2`,
|
|
`https://es.found.io:9230` or
|
|
`192.24.3.2:9300`. If no port is
|
|
specified, `9200` is used.
|
|
'';
|
|
};
|
|
|
|
filebeat = {
|
|
inputs = mkOption {
|
|
type = types.listOf json.type;
|
|
default = [];
|
|
internal = true;
|
|
description = ''
|
|
Inputs specify how Filebeat locates and processes
|
|
input data. Use <xref
|
|
linkend="opt-services.filebeat.inputs"/> instead.
|
|
|
|
See <link xlink:href="https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html"/>.
|
|
'';
|
|
};
|
|
modules = mkOption {
|
|
type = types.listOf json.type;
|
|
default = [];
|
|
internal = true;
|
|
description = ''
|
|
Filebeat modules provide a quick way to get started
|
|
processing common log formats. They contain default
|
|
configurations, Elasticsearch ingest pipeline
|
|
definitions, and Kibana dashboards to help you
|
|
implement and deploy a log monitoring solution.
|
|
|
|
Use <xref linkend="opt-services.filebeat.modules"/> instead.
|
|
|
|
See <link xlink:href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules.html"/>.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
default = {};
|
|
example = literalExpression ''
|
|
{
|
|
settings = {
|
|
output.elasticsearch = {
|
|
hosts = [ "myEShost:9200" ];
|
|
username = "filebeat_internal";
|
|
password = { _secret = "/var/keys/elasticsearch_password"; };
|
|
};
|
|
logging.level = "info";
|
|
};
|
|
};
|
|
'';
|
|
|
|
description = lib.mdDoc ''
|
|
Configuration for filebeat. See
|
|
<https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-reference-yml.html>
|
|
for supported values.
|
|
|
|
Options containing secret data should be set to an attribute
|
|
set containing the attribute `_secret` - a
|
|
string pointing to a file containing the value the option
|
|
should be set to. See the example to get a better picture of
|
|
this: in the resulting
|
|
{file}`filebeat.yml` file, the
|
|
`output.elasticsearch.password`
|
|
key will be set to the contents of the
|
|
{file}`/var/keys/elasticsearch_password` file.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
|
|
services.filebeat.settings.filebeat.inputs = attrValues cfg.inputs;
|
|
services.filebeat.settings.filebeat.modules = attrValues cfg.modules;
|
|
|
|
systemd.services.filebeat = {
|
|
description = "Filebeat log shipper";
|
|
wantedBy = [ "multi-user.target" ];
|
|
wants = [ "elasticsearch.service" ];
|
|
after = [ "elasticsearch.service" ];
|
|
serviceConfig = {
|
|
ExecStartPre = pkgs.writeShellScript "filebeat-exec-pre" ''
|
|
set -euo pipefail
|
|
|
|
umask u=rwx,g=,o=
|
|
|
|
${utils.genJqSecretsReplacementSnippet
|
|
cfg.settings
|
|
"/var/lib/filebeat/filebeat.yml"
|
|
}
|
|
'';
|
|
ExecStart = ''
|
|
${cfg.package}/bin/filebeat -e \
|
|
-c "/var/lib/filebeat/filebeat.yml" \
|
|
--path.data "/var/lib/filebeat"
|
|
'';
|
|
Restart = "always";
|
|
StateDirectory = "filebeat";
|
|
};
|
|
};
|
|
};
|
|
}
|