#!/bin/bash SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" . "${SCRIPT_DIR}/../share/logging.sh" . "${SCRIPT_DIR}/../share/os-detection.sh" # Configuration FILEBEAT_CONFIG_DIR="${SCRIPT_DIR}/../filebeat" FILEBEAT_INSTALL_DIR=$(GetFilebeatConfigDir) FILEBEAT_MODULES_D_DIR="${FILEBEAT_INSTALL_DIR}/modules.d" CONFIG_FILE="filebeat.yml" OS_TYPE=$(DetectOS) CheckRoot() { if [[ $EUID -ne 0 ]]; then LogError "This script must be run as root (use sudo)" exit 1 fi } CheckFilebeatInstalled() { if ! command -v filebeat &> /dev/null; then LogWarning "filebeat command not found in PATH" LogWarning "Make sure Filebeat is installed and configured" fi if [[ ! -d "$FILEBEAT_INSTALL_DIR" ]]; then LogInformation "Creating Filebeat config directory: $FILEBEAT_INSTALL_DIR" mkdir -p "$FILEBEAT_INSTALL_DIR" chmod 755 "$FILEBEAT_INSTALL_DIR" fi if [[ ! -d "$FILEBEAT_MODULES_D_DIR" ]]; then LogInformation "Creating Filebeat modules.d directory: $FILEBEAT_MODULES_D_DIR" mkdir -p "$FILEBEAT_MODULES_D_DIR" chmod 755 "$FILEBEAT_MODULES_D_DIR" fi } UpdateFilebeatConfig() { local user="$1" local password="$2" local host="$3" local config_file="${FILEBEAT_CONFIG_DIR}/${CONFIG_FILE}" local temp_file=$(mktemp) if [[ ! -f "$config_file" ]]; then LogError "Filebeat config file not found: $config_file" exit 1 fi LogInformation "Updating Elasticsearch configuration in $CONFIG_FILE" sed -e "s/username: \"[^\"]*\"/username: \"$user\"/" \ -e "s/password: \"[^\"]*\"/password: \"$password\"/" \ -e "s|hosts: \[\"[^\"]*\"\]|hosts: [\"$host\"]|" \ "$config_file" > "$temp_file" if grep -q "username: \"$user\"" "$temp_file" && \ grep -q "password: \"$password\"" "$temp_file" && \ grep -q "hosts: \[\"$host\"\]" "$temp_file"; then mv "$temp_file" "$config_file" LogInformation "Updated Elasticsearch settings: user=$user" else rm -f "$temp_file" LogError "Failed to update Elasticsearch configuration" exit 1 fi } InstallFilebeatConfigs() { local installed_count=0 local failed_count=0 # Install main configuration file LogInformation "Installing main Filebeat configuration file" # Install filebeat.yml if [[ -f "${FILEBEAT_CONFIG_DIR}/${CONFIG_FILE}" ]]; then LogInformation "Installing ${CONFIG_FILE}..." if cp "${FILEBEAT_CONFIG_DIR}/${CONFIG_FILE}" "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" && chmod 644 "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}"; then LogInformation "Installed: ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" ((installed_count++)) else LogError "Failed to install: ${CONFIG_FILE}" ((failed_count++)) fi else LogWarning "${CONFIG_FILE} not found in source directory" fi # Install modules.d configurations LogInformation "Installing Filebeat modules from ${FILEBEAT_CONFIG_DIR}/modules.d" if [[ -d "${FILEBEAT_CONFIG_DIR}/modules.d" ]]; then while IFS= read -r -d '' module_file; do local filename=$(basename "$module_file") local target_file="${FILEBEAT_MODULES_D_DIR}/${filename}" LogInformation "Installing module $filename..." if cp "$module_file" "$target_file" && chmod 644 "$target_file"; then LogInformation "Installed: $target_file" ((installed_count++)) else LogError "Failed to install: $filename" ((failed_count++)) fi done < <(find "${FILEBEAT_CONFIG_DIR}/modules.d" -name "*.yml" -type f -print0) else LogWarning "modules directory not found in source" fi LogInformation "Installation summary: $installed_count installed, $failed_count failed" if [[ $failed_count -gt 0 ]]; then exit 1 fi } ValidateFilebeatConfig() { LogInformation "Validating Filebeat configuration..." if command -v filebeat &> /dev/null; then if filebeat test config -c "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" 2>/dev/null; then LogInformation "Filebeat configuration validation passed" else LogWarning "Filebeat configuration validation failed or unavailable" LogWarning "Run manually: sudo filebeat test config -c ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" fi else LogWarning "Filebeat not available for config validation" fi } ShowStatus() { LogInformation "Filebeat configuration status:" LogInformation "OS: $OS_TYPE" LogInformation "Install directory: $FILEBEAT_INSTALL_DIR" LogInformation "" # Check main config file if [[ -f "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" ]]; then LogInformation "✓ Main config: ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" else LogWarning "✗ Main config not found: ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" fi # Check modules.d directory if [[ -d "$FILEBEAT_MODULES_D_DIR" ]]; then local module_count=$(find "$FILEBEAT_MODULES_D_DIR" -name "*.yml" -type f | wc -l) LogInformation "Module configurations: $module_count" if [[ $module_count -gt 0 ]]; then LogInformation "Module files:" find "$FILEBEAT_MODULES_D_DIR" -name "*.yml" -type f -exec basename {} \; | sort | while read -r file; do LogInformation " ✓ $file" done fi else LogWarning "Filebeat modules.d directory not found: $FILEBEAT_MODULES_D_DIR" fi LogInformation "" LogInformation "Commands:" LogInformation " Test config: sudo filebeat test config -c ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" LogInformation " Test output: sudo filebeat test output -c ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" local service_cmd=$(GetServiceCommand) if [[ "$OS_TYPE" == "macos" ]]; then LogInformation " Start Filebeat: sudo $service_cmd start filebeat" LogInformation " Check status: $service_cmd list | grep filebeat" else LogInformation " Start Filebeat: sudo $service_cmd start filebeat" LogInformation " Check status: sudo $service_cmd status filebeat" fi } RemoveFilebeatConfigs() { local removed_count=0 LogInformation "Removing Filebeat configurations..." # Remove main config file if [[ -f "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" ]]; then LogInformation "Removing ${CONFIG_FILE}..." rm -f "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" ((removed_count++)) fi # Remove modules.d configurations if [[ -d "$FILEBEAT_MODULES_D_DIR" ]]; then while IFS= read -r -d '' source_file; do local filename=$(basename "$source_file") local target_file="${FILEBEAT_MODULES_D_DIR}/${filename}" if [[ -f "$target_file" ]]; then LogInformation "Removing module $filename..." rm -f "$target_file" ((removed_count++)) fi done < <(find "${FILEBEAT_CONFIG_DIR}/modules.d" -name "*.yml" -type f -print0 2>/dev/null) fi if [[ $removed_count -gt 0 ]]; then LogInformation "Removed $removed_count Filebeat configurations" else LogWarning "No configurations were found to remove" fi } ShowUsage() { echo "Usage: $0 install " echo " $0 [remove|status|help]" echo "" echo "Commands:" echo " install - Install Filebeat configurations with Elasticsearch settings" echo " remove - Remove all Filebeat configurations" echo " status - Show status of configurations" echo " help - Show this help message" echo "" echo "Parameters for install:" echo " user - Elasticsearch username" echo " password - Elasticsearch password" echo " host - Elasticsearch host URL (e.g., http://localhost:9200)" echo "" echo "Examples:" echo " sudo $0 install elastic mypassword http://localhost:9200" echo " sudo $0 status" echo " sudo $0 remove" } Main() { local action="$1" case "$action" in install) if [[ $# -ne 4 ]]; then LogError "Install command requires 3 parameters: user, password, host" ShowUsage exit 1 fi local user="$2" local password="$3" local host="$4" LogInformation "Installing Filebeat configurations" LogInformation "Elasticsearch settings: user=$user" CheckRoot CheckFilebeatInstalled UpdateFilebeatConfig "$user" "$password" "$host" InstallFilebeatConfigs ValidateFilebeatConfig LogInformation "Filebeat setup completed successfully!" ;; remove) LogInformation "Removing Filebeat configurations" CheckRoot RemoveFilebeatConfigs ;; status) ShowStatus ;; help|--help|-h) ShowUsage ;; *) LogError "Unknown action: $action" ShowUsage exit 1 ;; esac } Main "$@"