deployment/roles/snort/tasks/flume.yml

#
#  Licensed to the Apache Software Foundation (ASF) under one or more
#  contributor license agreements.  See the NOTICE file distributed with
#  this work for additional information regarding copyright ownership.
#  The ASF licenses this file to You under the Apache License, Version 2.0
#  (the "License"); you may not use this file except in compliance with
#  the License.  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
#
---
- name: Install flume configurations
  copy: src={{ item.src }} dest={{ item.dest }}
  with_items:
    - { src: flume-snort.conf, dest: /etc/flume/conf/flume-snort.conf }

- name: Configure destination for snort alerts
  lineinfile: dest=/etc/flume/conf/flume-snort.conf regexp={{ item.regexp }} line={{ item.line }}
  with_items:
    - { regexp: '^snort\.sinks\.kafka-sink\.brokerList.*$',
        line: 'snort.sinks.kafka-sink.brokerList = {{ kafka_broker_url }}' }
    - { regexp: '^snort\.sinks\.kafka-sink\.topic.*$',
        line: 'snort.sinks.kafka-sink.topic = {{ snort_topic }}'}
    - { regexp: '^snort.sources.exec-source.command.*$',
        line: 'snort.sources.exec-source.command = tail -F {{ snort_alert_csv_path }}' }