ServerManagementUtils/orchestrator/setup-filebeat.sh

#!/bin/bash

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
. "${SCRIPT_DIR}/../share/logging.sh"

# Configuration
FILEBEAT_CONFIG_DIR="${SCRIPT_DIR}/../filebeat"
FILEBEAT_INSTALL_DIR="/etc/filebeat"
FILEBEAT_MODULES_D_DIR="${FILEBEAT_INSTALL_DIR}/modules.d"
CONFIG_FILE="filebeat.yml"

CheckRoot() {
    if [[ $EUID -ne 0 ]]; then
        LogError "This script must be run as root (use sudo)"
        exit 1
    fi
}

CheckFilebeatInstalled() {
    if ! command -v filebeat &> /dev/null; then
        LogWarning "filebeat command not found in PATH"
        LogWarning "Make sure Filebeat is installed and configured"
    fi
    
    if [[ ! -d "$FILEBEAT_INSTALL_DIR" ]]; then
        LogInformation "Creating Filebeat config directory: $FILEBEAT_INSTALL_DIR"
        mkdir -p "$FILEBEAT_INSTALL_DIR"
        chmod 755 "$FILEBEAT_INSTALL_DIR"
    fi
    
    if [[ ! -d "$FILEBEAT_MODULES_D_DIR" ]]; then
        LogInformation "Creating Filebeat modules.d directory: $FILEBEAT_MODULES_D_DIR"
        mkdir -p "$FILEBEAT_MODULES_D_DIR"
        chmod 755 "$FILEBEAT_MODULES_D_DIR"
    fi
}

UpdateFilebeatConfig() {
    local user="$1"
    local password="$2"
    local host="$3"
    local config_file="${FILEBEAT_CONFIG_DIR}/${CONFIG_FILE}"
    local temp_file=$(mktemp)
    
    if [[ ! -f "$config_file" ]]; then
        LogError "Filebeat config file not found: $config_file"
        exit 1
    fi
    
    LogInformation "Updating Elasticsearch configuration in $CONFIG_FILE"
    
    sed -e "s/username: \"[^\"]*\"/username: \"$user\"/" \
        -e "s/password: \"[^\"]*\"/password: \"$password\"/" \
        -e "s|hosts: \[\"[^\"]*\"\]|hosts: [\"$host\"]|" \
        "$config_file" > "$temp_file"
    
    if grep -q "username: \"$user\"" "$temp_file" && \
       grep -q "password: \"$password\"" "$temp_file" && \
       grep -q "hosts: [\"$host\"]" "$temp_file"; then
        mv "$temp_file" "$config_file"
        LogInformation "Updated Elasticsearch settings: user=$user"
    else
        rm -f "$temp_file"
        LogError "Failed to update Elasticsearch configuration"
        exit 1
    fi
}

InstallFilebeatConfigs() {
    local installed_count=0
    local failed_count=0
    
    # Install main configuration file
    LogInformation "Installing main Filebeat configuration file"
    
    # Install filebeat.yml
    if [[ -f "${FILEBEAT_CONFIG_DIR}/${CONFIG_FILE}" ]]; then
        LogInformation "Installing ${CONFIG_FILE}..."
        if cp "${FILEBEAT_CONFIG_DIR}/${CONFIG_FILE}" "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" && chmod 644 "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}"; then
            LogInformation "Installed: ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}"
            ((installed_count++))
        else
            LogError "Failed to install: ${CONFIG_FILE}"
            ((failed_count++))
        fi
    else
        LogWarning "${CONFIG_FILE} not found in source directory"
    fi
    
    # Install modules.d configurations
    LogInformation "Installing Filebeat modules from ${FILEBEAT_CONFIG_DIR}/modules.d"
    if [[ -d "${FILEBEAT_CONFIG_DIR}/modules.d" ]]; then
        while IFS= read -r -d '' module_file; do
            local filename=$(basename "$module_file")
            local target_file="${FILEBEAT_MODULES_D_DIR}/${filename}"
            
            LogInformation "Installing module $filename..."
            if cp "$module_file" "$target_file" && chmod 644 "$target_file"; then
                LogInformation "Installed: $target_file"
                ((installed_count++))
            else
                LogError "Failed to install: $filename"
                ((failed_count++))
            fi
        done < <(find "${FILEBEAT_CONFIG_DIR}/modules.d" -name "*.yml" -type f -print0)
    else
        LogWarning "modules directory not found in source"
    fi
    
    LogInformation "Installation summary: $installed_count installed, $failed_count failed"
    if [[ $failed_count -gt 0 ]]; then
        exit 1
    fi
}

ValidateFilebeatConfig() {
    LogInformation "Validating Filebeat configuration..."
    if command -v filebeat &> /dev/null; then
        if filebeat test config -c "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" 2>/dev/null; then
            LogInformation "Filebeat configuration validation passed"
        else
            LogWarning "Filebeat configuration validation failed or unavailable"
            LogWarning "Run manually: sudo filebeat test config -c ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}"
        fi
    else
        LogWarning "Filebeat not available for config validation"
    fi
}

ShowStatus() {
    LogInformation "Filebeat configuration status:"
    LogInformation ""
    
    # Check main config file
    if [[ -f "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" ]]; then
        LogInformation "✓ Main config: ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}"
    else
        LogWarning "✗ Main config not found: ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}"
    fi
    
    # Check modules.d directory
    if [[ -d "$FILEBEAT_MODULES_D_DIR" ]]; then
        local module_count=$(find "$FILEBEAT_MODULES_D_DIR" -name "*.yml" -type f | wc -l)
        LogInformation "Module configurations: $module_count"
        
        if [[ $module_count -gt 0 ]]; then
            LogInformation "Module files:"
            find "$FILEBEAT_MODULES_D_DIR" -name "*.yml" -type f -exec basename {} \; | sort | while read -r file; do
                LogInformation "  ✓ $file"
            done
        fi
    else
        LogWarning "Filebeat modules.d directory not found: $FILEBEAT_MODULES_D_DIR"
    fi
    
    LogInformation ""
    LogInformation "Commands:"
    LogInformation "  Test config: sudo filebeat test config -c ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}"
    LogInformation "  Test output: sudo filebeat test output -c ${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}"
    LogInformation "  Start Filebeat: sudo systemctl start filebeat"
    LogInformation "  Check status: sudo systemctl status filebeat"
}

RemoveFilebeatConfigs() {
    local removed_count=0
    
    LogInformation "Removing Filebeat configurations..."
    
    # Remove main config file
    if [[ -f "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}" ]]; then
        LogInformation "Removing ${CONFIG_FILE}..."
        rm -f "${FILEBEAT_INSTALL_DIR}/${CONFIG_FILE}"
        ((removed_count++))
    fi
    
    # Remove modules.d configurations
    if [[ -d "$FILEBEAT_MODULES_D_DIR" ]]; then
        while IFS= read -r -d '' source_file; do
            local filename=$(basename "$source_file")
            local target_file="${FILEBEAT_MODULES_D_DIR}/${filename}"
            
            if [[ -f "$target_file" ]]; then
                LogInformation "Removing module $filename..."
                rm -f "$target_file"
                ((removed_count++))
            fi
        done < <(find "${FILEBEAT_CONFIG_DIR}/modules.d" -name "*.yml" -type f -print0 2>/dev/null)
    fi
    
    if [[ $removed_count -gt 0 ]]; then
        LogInformation "Removed $removed_count Filebeat configurations"
    else
        LogWarning "No configurations were found to remove"
    fi
}

ShowUsage() {
    echo "Usage: $0 install <user> <password> <host>"
    echo "       $0 [remove|status|help]"
    echo ""
    echo "Commands:"
    echo "  install  - Install Filebeat configurations with Elasticsearch settings"
    echo "  remove   - Remove all Filebeat configurations"
    echo "  status   - Show status of configurations"
    echo "  help     - Show this help message"
    echo ""
    echo "Parameters for install:"
    echo "  user     - Elasticsearch username"
    echo "  password - Elasticsearch password"
    echo "  host     - Elasticsearch host URL (e.g., http://localhost:9200)"
    echo ""
    echo "Examples:"
    echo "  sudo $0 install elastic mypassword http://localhost:9200"
    echo "  sudo $0 status"
    echo "  sudo $0 remove"
}

Main() {
    local action="$1"
    
    case "$action" in
        install)
            if [[ $# -ne 4 ]]; then
                LogError "Install command requires 3 parameters: user, password, host"
                ShowUsage
                exit 1
            fi
            
            local user="$2"
            local password="$3"
            local host="$4"
            
            LogInformation "Installing Filebeat configurations"
            LogInformation "Elasticsearch settings: user=$user"
            
            CheckRoot
            CheckFilebeatInstalled
            UpdateFilebeatConfig "$user" "$password" "$host"
            InstallFilebeatConfigs
            ValidateFilebeatConfig
            LogInformation "Filebeat setup completed successfully!"
            ;;
        remove)
            LogInformation "Removing Filebeat configurations"
            CheckRoot
            RemoveFilebeatConfigs
            ;;
        status)
            ShowStatus
            ;;
        help|--help|-h)
            ShowUsage
            ;;
        *)
            LogError "Unknown action: $action"
            ShowUsage
            exit 1
            ;;
    esac
}

Main "$@"