Add identification field for Logstash instance (NETWAYS#138)

* Add identification field for Logstash instance
* Make ident field name configurable

fixes NETWAYS#137

Author: widhalmt

README.md

@@ -50,6 +50,8 @@ Aside from `logstash.yml` we can manage Logstashs pipelines.
 * *logstash_pipelines*: List of pipelines with optional URL to repo (see docs/pipelines.md for details)
 * *logstash_global_ecs*: Set ECS compatibilty mode (default: none. Possible values: `disabled` or `v1`)
 * *logstash_elasticsearch_output*: Enable default pipeline to Elasticsearch (default: `true`)
+* *logstash_ident*: Add a field identifying the node that processed an event (default: `true`)
+* *logstash_ident_field_name*: Name of the identifying the instance (default: `"[netways][instance]"`)
 * *logstash_beats_input*: Enable default pipeline with `beats` input (default: `true`)
 * *logstash_beats_input_congestion*: Optional congestion threshold for the beats input pipeline
 * *logstash_beats_tls*: Activate TLS for the beats input pipeline (default: none but `true` with full stack setup if not set)

defaults/main.yml

@@ -51,6 +51,8 @@ logstash_logging_file: true
 logstash_logging_slow_console: true
 logstash_logging_slow_file: true
 
+logstash_ident: true
+logstash_ident_field_name: "[netways][instance]"
 logstash_pipeline_identifier: true
 logstash_pipeline_identifier_field_name: "[netways][pipeline]"
 logstash_pipeline_identifier_defaults: false

templates/elasticsearch-output.conf.j2

@@ -7,6 +7,16 @@ filter {
   }
 }
 
+{% endif %}
+{% if logstash_ident | bool %}
+filter {
+  mutate {
+    add_field => {
+      "{{ logstash_ident_field_name }}" => "{{ ansible_hostname }}"
+    }
+  }
+}
+
 {% endif %}
 output {
   elasticsearch {