Skip to content

[Documentation]: Fix example playbook YAML and document Beats output defaults #520

Closed

Description

@afeefghannam89

The README example playbook has issues and the Beats output defaults are undocumented.

  • YAML indentation error in the rsyslog pre_task (ansible.builtin.service indented 7 spaces instead of 6) → copy-paste fails.
  • The example silently assumes Logstash: beats_filebeat_output defaults to logstash, so without a Logstash node Filebeat ships nowhere. Add a note — with Logstash set the Beats outputs to logstash, without it to elasticsearch.
  • Document the current output defaults (filebeat → logstash, auditbeat/metricbeat → elasticsearch) and note they are inconsistent (unification tracked in [Feature]: Unify default Beats output to elasticsearch #519).
  • Correct the stated elasticstack_release default 7 → 8 (README.md:103, docs/getting-started.md:62; check meta/argument_specs.yml too).

Docs only, non-breaking. Related: #422.

Activity

  1. added this to the 1.0.0 milestone on Aug 4, 2026
  2. afeefghannam89 commented on Sep 16, 2026

    @afeefghannam89
    MemberAuthor

    The point 2 and 3 are resolved with the description of the related variables in argument_specs in #551

  3. added a commit that references this issue on Sep 23, 2026
    296b24a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    component:beatsroles/beats - shared, or several beats at once

    Type

    No type

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions