如何在我的剧本中执行 splunk_index ？进程退出，代码为 4

Question

我的索引任务

- name: Configure Splunk Indexes
   include_role:
    name: ansible-role-risk-splunkforwarder
  vars:
    action: config
    splunk_enabled: true
    splunk_server: "{{ splunk_server_url }}"
    sw_version: "{{ splunk_version }}"
    service_name: splunkforwarder
    tags: [splunk]
    files_to_index:
     - path: "{{ base_logs_dir }}/*.log"
          index: "{{ splunk_index }}"
          sourcetype: "{{ project_name }}-info"
          ignore_older_than: 48h
          time_before_close: 120

运行管道后，我得到了

The offending line appears to be:
- path: "{{ base_logs_dir }}/*.log"
index: "{{ splunk_index }}"
^ here
We could be wrong, but this one looks like it might be an issue with
missing quotes. Always quote template expression brackets when they
start a value. For instance:
with_items:
- {{ foo }}
Should be written as:
with_items:
- "{{ foo }}"

Process exited with code 4

是的，Teamcity 错了。我应该如何重新格式化我的 files_to_index？

Answer 1

根据错误，运行此剧本时，它不会采用上述变量 - 路径：“{{ base_logs_dir }}/*.log”，因为此定义的变量中缺少空格和缩进。正确的格式如下。

---
- name: configure splunk index
  hosts: all
  gather_facts: false
  include_role:
    name: ansible-role-risk-splunkforwarder
  vars:
    action: config
    splunk_enabled: true
    splunk_server: "{{ splunk_server_url }}"
    sw_version: "{{ splunk_version }}"
    service_name: splunkforwarder
    tags: [splunk]
    files_to_index:
      - path: "{{ base_logs_dir }}/*.log"
        index: "{{ splunk_index }}"
        sourcetype: "{{ project_name }}-info"
        ignore_older_than: 48h
        time_before_close: 120

更新了索引任务。