From c47224b331cddf3cf14ecbf93375901407879ddd Mon Sep 17 00:00:00 2001 From: Saeid Hassanabadi Date: Mon, 27 Jul 2026 13:31:10 +0200 Subject: [PATCH 1/4] logstash: make redis host and TLS configurable for simple pipelines The simple input/output (and default redis) templates hardcoded host => localhost with no TLS option, so pipelines could only reach a co-located Redis in plaintext. Add logstash_redis_input_host, logstash_redis_output_host and logstash_redis_tls (defaults keep the previous behaviour: localhost, no TLS). --- roles/logstash/README.md | 3 +++ roles/logstash/defaults/main.yml | 6 ++++++ roles/logstash/templates/redis-input.conf.j2 | 5 ++++- roles/logstash/templates/redis-output.conf.j2 | 5 ++++- roles/logstash/templates/simple-input.conf.j2 | 5 ++++- roles/logstash/templates/simple-output.conf.j2 | 5 ++++- 6 files changed, 25 insertions(+), 4 deletions(-) diff --git a/roles/logstash/README.md b/roles/logstash/README.md index c1be4902..1d7964c6 100644 --- a/roles/logstash/README.md +++ b/roles/logstash/README.md @@ -93,6 +93,9 @@ Run only parts of the role with `--tags`: | `logstash_forwarder_queue_type` | `str` | `"memory"` | `memory`, `persisted` | Queue type for the default Elasticsearch forwarder pipeline. Use "persisted" for an on-disk persistent queue. | | `logstash_forwarder_queue_max_bytes` | `str` | `"1gb"` | — | Maximum queue size for the default Elasticsearch forwarder pipeline. | | `logstash_redis_password` | `str` | N/A | — | Password used when the simple inputs/outputs connect to Redis. Unset by default. | +| `logstash_redis_input_host` | `str` | `"localhost"` | — | Redis host that simple pipeline inputs (and the default forwarder input) read from. | +| `logstash_redis_output_host` | `str` | `"localhost"` | — | Redis host that simple pipeline outputs (and the default input pipeline) write to. | +| `logstash_redis_tls` | `bool` | `false` | — | Enable TLS on the simple Redis inputs/outputs (`ssl`/`ssl_enabled`). | | `logstash_elasticsearch` | `list` of `str` | N/A | — | Elasticsearch hosts for the default output. Defaults to the nodes from the elasticsearch group, or localhost when used standalone. | | `logstash_validate_after_inactivity` | `str` | `"300"` | — | Seconds Logstash waits before validating a previously idle connection to Elasticsearch. | | `logstash_sniffing` | `bool` | `false` | — | Enable sniffing for additional Elasticsearch nodes. | diff --git a/roles/logstash/defaults/main.yml b/roles/logstash/defaults/main.yml index d114438d..a347085b 100644 --- a/roles/logstash/defaults/main.yml +++ b/roles/logstash/defaults/main.yml @@ -43,6 +43,12 @@ logstash_input_queue_type: memory logstash_input_queue_max_bytes: 1gb logstash_forwarder_queue_type: memory logstash_forwarder_queue_max_bytes: 1gb + +# redis connection for simple pipeline inputs/outputs +logstash_redis_input_host: localhost +logstash_redis_output_host: localhost +logstash_redis_tls: false + logstash_sniffing: false # logstash role / user diff --git a/roles/logstash/templates/redis-input.conf.j2 b/roles/logstash/templates/redis-input.conf.j2 index 0481dc53..62bbb909 100644 --- a/roles/logstash/templates/redis-input.conf.j2 +++ b/roles/logstash/templates/redis-input.conf.j2 @@ -1,6 +1,9 @@ input { redis { - host => "localhost" + host => "{{ logstash_redis_input_host }}" +{% if logstash_redis_tls | bool %} + ssl => true +{% endif %} data_type => "list" key => "forwarder" {% if logstash_redis_password is defined %} diff --git a/roles/logstash/templates/redis-output.conf.j2 b/roles/logstash/templates/redis-output.conf.j2 index 59c5a578..e47b4fa8 100644 --- a/roles/logstash/templates/redis-output.conf.j2 +++ b/roles/logstash/templates/redis-output.conf.j2 @@ -10,7 +10,10 @@ filter { {% endif %} output { redis { - host => "localhost" + host => "{{ logstash_redis_output_host }}" +{% if logstash_redis_tls | bool %} + ssl_enabled => true +{% endif %} data_type => "list" key => "input" {% if logstash_beats_input_congestion is defined %} congestion_threshold => {{ logstash_beats_input_congestion }}{% endif %} diff --git a/roles/logstash/templates/simple-input.conf.j2 b/roles/logstash/templates/simple-input.conf.j2 index ce871c7f..0144bbe4 100644 --- a/roles/logstash/templates/simple-input.conf.j2 +++ b/roles/logstash/templates/simple-input.conf.j2 @@ -3,7 +3,10 @@ input { # {{ input.name }} input redis { - host => "localhost" + host => "{{ logstash_redis_input_host }}" +{% if logstash_redis_tls | bool %} + ssl => true +{% endif %} data_type => "list" key => "{{ input.key }}" {% if logstash_redis_password is defined %} diff --git a/roles/logstash/templates/simple-output.conf.j2 b/roles/logstash/templates/simple-output.conf.j2 index 4b3ace63..ad1564f3 100644 --- a/roles/logstash/templates/simple-output.conf.j2 +++ b/roles/logstash/templates/simple-output.conf.j2 @@ -16,7 +16,10 @@ output { {% if not loop.first and pipelinename.exclusive | bool %}else {% endif %}{% if (not loop.last and pipelinename.exclusive | bool) or not pipelinename.exclusive %}if {% endif %}{% if output.condition is defined %}{{ output.condition }} {% endif %}{ {% endif %} redis { - host => "localhost" + host => "{{ logstash_redis_output_host }}" +{% if logstash_redis_tls | bool %} + ssl_enabled => true +{% endif %} data_type => "list" key => "{{ output.key }}" {% if logstash_redis_password is defined %} From bd47ad9a5b3d9a48f357d505cf3fbb8c0ace5fbd Mon Sep 17 00:00:00 2001 From: Saeid Hassanabadi Date: Mon, 27 Jul 2026 15:43:50 +0200 Subject: [PATCH 2/4] Document redis host/tls vars in argument_specs DocSmith validation requires every defaults variable to be present in meta/argument_specs.yml. Add specs for logstash_redis_input_host, logstash_redis_output_host and logstash_redis_tls. --- roles/logstash/meta/argument_specs.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/roles/logstash/meta/argument_specs.yml b/roles/logstash/meta/argument_specs.yml index 95ac3641..2e3a663b 100644 --- a/roles/logstash/meta/argument_specs.yml +++ b/roles/logstash/meta/argument_specs.yml @@ -253,6 +253,21 @@ argument_specs: type: str description: Password used when the simple inputs/outputs connect to Redis. Unset by default. + logstash_redis_input_host: + type: str + default: localhost + description: Redis host that the simple pipeline inputs connect to. + + logstash_redis_output_host: + type: str + default: localhost + description: Redis host that the simple pipeline outputs connect to. + + logstash_redis_tls: + type: bool + default: false + description: Whether the simple pipeline inputs/outputs use TLS to connect to Redis. + # ----- Elasticsearch connection / output ----- logstash_elasticsearch: type: list From fdcf490108a3183bee8f2cccef6bf507c65a36c1 Mon Sep 17 00:00:00 2001 From: Saeid Hassanabadi Date: Mon, 27 Jul 2026 15:50:52 +0200 Subject: [PATCH 3/4] Align redis var descriptions in argument_specs with README Match the wording already present in the generated README so the DocSmith README drift check passes. Descriptions now note that input/output hosts also cover the built-in forwarder/input pipelines and that logstash_redis_tls toggles ssl/ssl_enabled. --- roles/logstash/meta/argument_specs.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/logstash/meta/argument_specs.yml b/roles/logstash/meta/argument_specs.yml index 2e3a663b..9c9222a4 100644 --- a/roles/logstash/meta/argument_specs.yml +++ b/roles/logstash/meta/argument_specs.yml @@ -256,17 +256,17 @@ argument_specs: logstash_redis_input_host: type: str default: localhost - description: Redis host that the simple pipeline inputs connect to. + description: Redis host that simple pipeline inputs (and the default forwarder input) read from. logstash_redis_output_host: type: str default: localhost - description: Redis host that the simple pipeline outputs connect to. + description: Redis host that simple pipeline outputs (and the default input pipeline) write to. logstash_redis_tls: type: bool default: false - description: Whether the simple pipeline inputs/outputs use TLS to connect to Redis. + description: Enable TLS on the simple Redis inputs/outputs (`ssl`/`ssl_enabled`). # ----- Elasticsearch connection / output ----- logstash_elasticsearch: From a346c326f71eed8b6aef0ce465f6454eafdee653 Mon Sep 17 00:00:00 2001 From: Saeid Hassanabadi Date: Wed, 29 Jul 2026 10:45:58 +0200 Subject: [PATCH 4/4] logstash: support full SSL options on redis outputs Address review feedback: when logstash_redis_tls is enabled, allow supplying certificate, key, key passphrase, certificate authorities, supported protocols and verification mode on the redis outputs (built-in and simple pipelines). All optional, rendered only when defined; cipher suites intentionally omitted. The redis input plugin only exposes a boolean ssl option, so these granular options apply to outputs only. --- roles/logstash/README.md | 6 +++ roles/logstash/meta/argument_specs.yml | 38 +++++++++++++++++++ roles/logstash/templates/redis-output.conf.j2 | 18 +++++++++ .../logstash/templates/simple-output.conf.j2 | 18 +++++++++ 4 files changed, 80 insertions(+) diff --git a/roles/logstash/README.md b/roles/logstash/README.md index 1d7964c6..561f7462 100644 --- a/roles/logstash/README.md +++ b/roles/logstash/README.md @@ -96,6 +96,12 @@ Run only parts of the role with `--tags`: | `logstash_redis_input_host` | `str` | `"localhost"` | — | Redis host that simple pipeline inputs (and the default forwarder input) read from. | | `logstash_redis_output_host` | `str` | `"localhost"` | — | Redis host that simple pipeline outputs (and the default input pipeline) write to. | | `logstash_redis_tls` | `bool` | `false` | — | Enable TLS on the simple Redis inputs/outputs (`ssl`/`ssl_enabled`). | +| `logstash_redis_ssl_certificate` | `str` | N/A | — | Path to the SSL certificate for the Redis outputs (the redis output plugin only; the input plugin has no such option). Rendered only when logstash_redis_tls is true. | +| `logstash_redis_ssl_key` | `str` | N/A | — | Path to the SSL key for the Redis outputs. Rendered only when logstash_redis_tls is true. | +| `logstash_redis_ssl_key_passphrase` | `str` | N/A | — | Passphrase for logstash_redis_ssl_key. Rendered only when logstash_redis_tls is true. | +| `logstash_redis_ssl_certificate_authorities` | `list` of `str` | N/A | — | List of CA certificate paths used to verify the Redis server on the Redis outputs. Rendered only when logstash_redis_tls is true. | +| `logstash_redis_ssl_supported_protocols` | `str` | N/A | — | TLS protocol version accepted on the Redis outputs (for example "TLSv1.3"). Rendered only when logstash_redis_tls is true. | +| `logstash_redis_ssl_verification_mode` | `str` | N/A | — | Certificate verification mode for the Redis outputs ("full" or "none"). Rendered only when logstash_redis_tls is true. | | `logstash_elasticsearch` | `list` of `str` | N/A | — | Elasticsearch hosts for the default output. Defaults to the nodes from the elasticsearch group, or localhost when used standalone. | | `logstash_validate_after_inactivity` | `str` | `"300"` | — | Seconds Logstash waits before validating a previously idle connection to Elasticsearch. | | `logstash_sniffing` | `bool` | `false` | — | Enable sniffing for additional Elasticsearch nodes. | diff --git a/roles/logstash/meta/argument_specs.yml b/roles/logstash/meta/argument_specs.yml index 9c9222a4..7fd244f1 100644 --- a/roles/logstash/meta/argument_specs.yml +++ b/roles/logstash/meta/argument_specs.yml @@ -268,6 +268,44 @@ argument_specs: default: false description: Enable TLS on the simple Redis inputs/outputs (`ssl`/`ssl_enabled`). + logstash_redis_ssl_certificate: + type: str + description: >- + Path to the SSL certificate for the Redis outputs (the redis output + plugin only; the input plugin has no such option). Rendered only when + logstash_redis_tls is true. + + logstash_redis_ssl_key: + type: str + description: >- + Path to the SSL key for the Redis outputs. Rendered only when + logstash_redis_tls is true. + + logstash_redis_ssl_key_passphrase: + type: str + description: >- + Passphrase for logstash_redis_ssl_key. Rendered only when + logstash_redis_tls is true. + + logstash_redis_ssl_certificate_authorities: + type: list + elements: str + description: >- + List of CA certificate paths used to verify the Redis server on the + Redis outputs. Rendered only when logstash_redis_tls is true. + + logstash_redis_ssl_supported_protocols: + type: str + description: >- + TLS protocol version accepted on the Redis outputs (for example + "TLSv1.3"). Rendered only when logstash_redis_tls is true. + + logstash_redis_ssl_verification_mode: + type: str + description: >- + Certificate verification mode for the Redis outputs ("full" or + "none"). Rendered only when logstash_redis_tls is true. + # ----- Elasticsearch connection / output ----- logstash_elasticsearch: type: list diff --git a/roles/logstash/templates/redis-output.conf.j2 b/roles/logstash/templates/redis-output.conf.j2 index e47b4fa8..960fc95e 100644 --- a/roles/logstash/templates/redis-output.conf.j2 +++ b/roles/logstash/templates/redis-output.conf.j2 @@ -13,6 +13,24 @@ output { host => "{{ logstash_redis_output_host }}" {% if logstash_redis_tls | bool %} ssl_enabled => true +{% if logstash_redis_ssl_certificate is defined %} + ssl_certificate => "{{ logstash_redis_ssl_certificate }}" +{% endif %} +{% if logstash_redis_ssl_key is defined %} + ssl_key => "{{ logstash_redis_ssl_key }}" +{% endif %} +{% if logstash_redis_ssl_key_passphrase is defined %} + ssl_key_passphrase => "{{ logstash_redis_ssl_key_passphrase }}" +{% endif %} +{% if logstash_redis_ssl_certificate_authorities is defined %} + ssl_certificate_authorities => [{% for ca in logstash_redis_ssl_certificate_authorities %}"{{ ca }}"{% if not loop.last %}, {% endif %}{% endfor %}] +{% endif %} +{% if logstash_redis_ssl_supported_protocols is defined %} + ssl_supported_protocols => "{{ logstash_redis_ssl_supported_protocols }}" +{% endif %} +{% if logstash_redis_ssl_verification_mode is defined %} + ssl_verification_mode => "{{ logstash_redis_ssl_verification_mode }}" +{% endif %} {% endif %} data_type => "list" key => "input" diff --git a/roles/logstash/templates/simple-output.conf.j2 b/roles/logstash/templates/simple-output.conf.j2 index ad1564f3..0b239f28 100644 --- a/roles/logstash/templates/simple-output.conf.j2 +++ b/roles/logstash/templates/simple-output.conf.j2 @@ -19,6 +19,24 @@ output { host => "{{ logstash_redis_output_host }}" {% if logstash_redis_tls | bool %} ssl_enabled => true +{% if logstash_redis_ssl_certificate is defined %} + ssl_certificate => "{{ logstash_redis_ssl_certificate }}" +{% endif %} +{% if logstash_redis_ssl_key is defined %} + ssl_key => "{{ logstash_redis_ssl_key }}" +{% endif %} +{% if logstash_redis_ssl_key_passphrase is defined %} + ssl_key_passphrase => "{{ logstash_redis_ssl_key_passphrase }}" +{% endif %} +{% if logstash_redis_ssl_certificate_authorities is defined %} + ssl_certificate_authorities => [{% for ca in logstash_redis_ssl_certificate_authorities %}"{{ ca }}"{% if not loop.last %}, {% endif %}{% endfor %}] +{% endif %} +{% if logstash_redis_ssl_supported_protocols is defined %} + ssl_supported_protocols => "{{ logstash_redis_ssl_supported_protocols }}" +{% endif %} +{% if logstash_redis_ssl_verification_mode is defined %} + ssl_verification_mode => "{{ logstash_redis_ssl_verification_mode }}" +{% endif %} {% endif %} data_type => "list" key => "{{ output.key }}"