From e00c2b061d3fc3e14464e5102920b244eda4ee7f Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Fri, 22 Jul 2022 13:29:02 +0100
Subject: [PATCH] Update filebeat to 8.x

---
 .kitchen.yml                             | 9 ++++++---
 cookbooks/apt/recipes/default.rb         | 8 ++++++++
 cookbooks/logstash/attributes/default.rb | 2 +-
 roles/logstash-forwarder.rb              | 2 +-
 roles/web-frontend.rb                    | 6 +++---
 5 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/.kitchen.yml b/.kitchen.yml
index 6dc0dad22..f9ac5d243 100644
--- a/.kitchen.yml
+++ b/.kitchen.yml
@@ -177,11 +177,14 @@ suites:
     attributes:
       logstash:
         forwarder:
-          filebeat.prospectors:
-            - input_type: log
+          filebeat.inputs:
+            - type: filestream
+              id: apache
               paths:
                 - /var/log/apache2/access.log
-              type: apache
+              fields:
+                type: apache
+              fields_under_root: true
   - name: mail
     run_list:
       - role[mail]
diff --git a/cookbooks/apt/recipes/default.rb b/cookbooks/apt/recipes/default.rb
index c1355ec76..c7e53c669 100644
--- a/cookbooks/apt/recipes/default.rb
+++ b/cookbooks/apt/recipes/default.rb
@@ -123,6 +123,14 @@ apt_repository "elasticsearch6.x" do
   key "D27D666CD88E42B4"
 end
 
+apt_repository "elasticsearch8.x" do
+  action repository_actions["elasticsearch8.x"]
+  uri "https://artifacts.elastic.co/packages/8.x/apt"
+  distribution "stable"
+  components ["main"]
+  key "D27D666CD88E42B4"
+end
+
 apt_repository "passenger" do
   action repository_actions["passenger"]
   uri "https://oss-binaries.phusionpassenger.com/apt/passenger"
diff --git a/cookbooks/logstash/attributes/default.rb b/cookbooks/logstash/attributes/default.rb
index ff9cace3e..1b97ce335 100644
--- a/cookbooks/logstash/attributes/default.rb
+++ b/cookbooks/logstash/attributes/default.rb
@@ -1,6 +1,6 @@
 default[:logstash][:forwarder]["output.logstash"]["hosts"] = ["logstash.openstreetmap.org:5044"]
 default[:logstash][:forwarder]["output.logstash"]["ssl.certificate_authorities"] = "/etc/filebeat/filebeat.crt"
 default[:logstash][:forwarder]["output.logstash"]["ssl.verification_mode"] = "none"
-default[:logstash][:forwarder]["filebeat.prospectors"] = []
+default[:logstash][:forwarder]["filebeat.inputs"] = []
 
 default[:elasticsearch][:cluster][:name] = "logstash"
diff --git a/roles/logstash-forwarder.rb b/roles/logstash-forwarder.rb
index cf7e7461b..509934ae4 100644
--- a/roles/logstash-forwarder.rb
+++ b/roles/logstash-forwarder.rb
@@ -3,7 +3,7 @@ description "Role applied to all logstash forwarders"
 
 default_attributes(
   :apt => {
-    :sources => ["elasticsearch6.x"]
+    :sources => ["elasticsearch8.x"]
   }
 )
 
diff --git a/roles/web-frontend.rb b/roles/web-frontend.rb
index 2a316491a..500fb437f 100644
--- a/roles/web-frontend.rb
+++ b/roles/web-frontend.rb
@@ -15,9 +15,9 @@ default_attributes(
   },
   :logstash => {
     :forwarder => {
-      "filebeat.prospectors" => [
-        { "input_type" => "log", "paths" => ["/var/log/apache2/access.log"], "fields" => { "type" => "apache" } },
-        { "input_type" => "log", "paths" => ["/var/log/web/rails-logstash.log"], "fields" => { "type" => "rails" } }
+      "filebeat.inputs" => [
+        { "type" => "filestream", "id" => "apache", "paths" => ["/var/log/apache2/access.log"], "fields" => { "type" => "apache" }, "fields_under_root" => true },
+        { "type" => "filestream", "id" => "rails", "paths" => ["/var/log/web/rails-logstash.log"], "fields" => { "type" => "rails" }, "fields_under_root" => true }
       ]
     }
   },
-- 
2.45.1