ansible

How to do splunk_index in my playbook? Process exited with code 4

My index task

- name: Configure Splunk Indexes
   include_role:
    name: ansible-role-risk-splunkforwarder
  vars:
    action: config
    splunk_enabled: true
    splunk_server: "{{ splunk_server_url }}"
    sw_version: "{{ splunk_version }}"
    service_name: splunkforwarder
    tags: [splunk]
    files_to_index:
     - path: "{{ base_logs_dir }}/*.log"
          index: "{{ splunk_index }}"
          sourcetype: "{{ project_name }}-info"
          ignore_older_than: 48h
          time_before_close: 120

After I run the pipeline I got

The offending line appears to be:
- path: "{{ base_logs_dir }}/*.log"
index: "{{ splunk_index }}"
^ here
We could be wrong, but this one looks like it might be an issue with
missing quotes. Always quote template expression brackets when they
start a value. For instance:
with_items:
- {{ foo }}
Should be written as:
with_items:
- "{{ foo }}"

Process exited with code 4

Yes,Teamcity is wrong. How should I reformat my files_to_index?

Solution

  • As per the error, while running this playbook it will not take this mentioned variable - path: "{{ base_logs_dir }}/*.log" because spacing and indentations are missing in this defined variable. Here is the correct format as below.

    ---
- name: configure splunk index
  hosts: all
  gather_facts: false
  include_role:
    name: ansible-role-risk-splunkforwarder
  vars:
    action: config
    splunk_enabled: true
    splunk_server: "{{ splunk_server_url }}"
    sw_version: "{{ splunk_version }}"
    service_name: splunkforwarder
    tags: [splunk]
    files_to_index:
      - path: "{{ base_logs_dir }}/*.log"
        index: "{{ splunk_index }}"
        sourcetype: "{{ project_name }}-info"
        ignore_older_than: 48h
        time_before_close: 120

    Updated index task.