Add Icinga module to Filebeat

[bobapple]

This commit introduces the Icinga module to Filebeat. It is capable
of processing the main, debug and startup log of the Icinga daemon.

[elasticmachine]

Jenkins standing by to test this. If you aren't a maintainer, you can ignore this comment. Someone with commit access, please review this and clear it for Jenkins to run.

[elasticmachine]

Jenkins standing by to test this. If you aren't a maintainer, you can ignore this comment. Someone with commit access, please review this and clear it for Jenkins to run.

[ruflin]

@bobapple Thans a lot for the contribution and sorry for the late reply. We try to provide feedback soon. Could you rebase this one on master and also check the failing tests?

[bobapple]

@ruflin no worries. I rebased on master and fixed one of my test logs. The Travis CI tests on TARGETS=-C filebeat testsuit are happy now.

However, tests with TARGETS=check are still failing and I believe this is caused by some missing settings in filebeat.full.yaml:

diff --git a/filebeat/filebeat.full.yml b/filebeat/filebeat.full.yml
index c91a8f3..e3fcfa6 100644
--- a/filebeat/filebeat.full.yml
+++ b/filebeat/filebeat.full.yml
@@ -59,6 +59,15 @@ filebeat.modules:
 #------------------------------- Auditd Module -------------------------------
 #- module: auditd
   #log:
+    #enabled: true
+
+    # Set custom paths for the log files. If left empty,
+    # Filebeat will choose the paths depending on your OS.
+    #var.paths:
+
+    # Prospector configuration (advanced). Any prospector configuration option
+    # can be added under this section.
+    #prospector:
 
 #------------------------------- Icinga Module -------------------------------
 #- module: icinga
git update-index --refresh
filebeat/filebeat.full.yml: needs update
make: *** [check] Error 1

I am not sure tho, maybe you can give me a hint

[tsg]

@bobapple Running make update in the filebeat folder should fix that. You modified the correct files (the ones under the module directory), but you need a make update to modify the top level filebeat.full.yml.

[tsg]

Do you happen to also have some Kibana dashboards created? It would be nice to include at least a simple dashboard with the module, so people get a good starting point. Let me know if you need help with saving the dashboards.

[tsg]

We've recently change this from error to error.message. Could you update it everywhere in this PR as well, please?

[tsg]

I've looked over the code and tested the new module a little bit. All looks 👍 👍

Can you review the small comments above? Also, can you add a line in the CHANGELOG.asciidoc file? Thanks!

[bobapple]

@tsg thank you for the feedback! I made the requested changes and added Kibana dashboards.

[ruflin]

I fixed the conflict in the changelog.

[monicasarbu]

@bobapple Can you please run make update and commit the changes? It should add the Icinga changes in docs/modules/icinga.asciidoc and filebeat.yml. Thanks!

[bobapple]

@monicasarbu I made the requested changes, even though the Icinga module configuration was removed from filebeat.yml after I ran make update. Tests are now running smooth again.