Inquiry: FreeBSD Port of Sidecar In The Works?

[jandrusk]

Would like to know if their is a FreeBSD port of Sidecar in the works. Have had zero success shipping FreeBSD logs to Graylog.

[mpfz0r]

This could be done. What's currently stopping us, is the lack of FreeBSD support in the gosigar library.
We could either implement that, switch to gopsutils or just don't ship metrics for FreeBSD.

[ltning]

What is the current state of this? With the old beats plugin being deprecated, this is going to become a real issue, I suppose.

Note that we have strong reservations about the sidecar approach, as it requires the graylog host to be able to connect to the nodes that are having their logs collected. This breaks down the security model of our environment, which the current beats plugin does not. I may have misunderstood something, and it's a discussion for a different issue (only slight pun intended) I suppose.

[mpfz0r]

What is the current state of this? With the old beats plugin being deprecated, this is going to become a real issue, I suppose.

I haven't gotten around to it yet. Let's see if I find some time, but no promises :)
However, we haven't set a time when we're gonna remove support for the old sidecar yet.
It's definitely gonna still be supported in 3.1.

Note that we have strong reservations about the sidecar approach, as it requires the graylog host to be able to connect to the nodes that are having their logs collected.

It works in the opposite direction. The sidecars connect to the graylog server, just like the beats collectors and the old sidecar does.

[ltning]

What is the current state of this? With the old beats plugin being deprecated, this is going to become a real issue, I suppose.

I haven't gotten around to it yet. Let's see if I find some time, but no promises :)
However, we haven't set a time when we're gonna remove support for the old sidecar yet.
It's definitely gonna still be supported in 3.1.

Can it be used like the current one - manually configured - at all?

Note that we have strong reservations about the sidecar approach, as it requires the graylog host to be able to connect to the nodes that are having their logs collected.

It works in the opposite direction. The sidecars connect to the graylog server, just like the beats collectors and the old sidecar does.

Right, I realised that ((very) late) last night as I was reading up on this again. It's still an issue though; we're using Puppet for all our configuration management needs, and adding another purpose-built config management system in addition is not something we'd like. One of the major benefits of Puppet is that we can have dynamic configuration; when new nodes make their presence known to the Puppet infrastructure, existing nodes can be automatically reconfigured to recognise them and key- and certificate management is automated.

[mariussturm]

@ltning if you have a fully deployed Puppet setup already, there is no need for the Sidecar at all. Just use Puppet to manage the Filebeat configuration directly and you are done. The Sidecar is not doing any ingestion of log messages so it makes no difference what system is taking care of the configuration file.