---
- name: Install logstash
  become: yes
  apt:
    name: logstash
    state: present

- name: Create Grok patterns directory
  become: yes
  file:
    path: /etc/logstash/patterns
    state: directory
    owner: root
    group: root
    mode: u=rwx,g=rx,o=rx

- name: Deploy Grok patterns
  become: yes
  copy:
    src: "{{ item }}"
    dest: /etc/logstash/patterns/
    owner: logstash
    group: logstash
    mode: u=r,g=,o=
  with_fileglob:
    - patterns/*

- name: Deploy logstash configuration
  become: yes
  template:
    src: "{{ item }}.j2"
    dest: "/etc/logstash/conf.d/{{ item }}"
    owner: logstash
    group: logstash
    mode: u=r,g=,o=
  loop:
    - main.conf
    - sshd.conf
    - pam_unix.conf
  notify: Restart logstash

- name: Enable logstash service
  become: yes
  systemd:
    name: logstash.service
    state: started
    enabled: yes
...