diff mbox series

[2/2] package/filebeat: new package

Message ID dd3cad7bdab3590524ea1273910c66812cb4f4d8.1698657764.git.yann.morin@orange.com
State Changes Requested
Headers show
Series [1/2] package/pkg-golang: allow packages to provide extldflags | expand

Commit Message

Yann E. MORIN Oct. 30, 2023, 9:22 a.m. UTC 
From: "Yann E. MORIN" <yann.morin@orange.com>

filebeat is one of the many Elastic 'beats' that can send data to a
remote ElasticSearch (ES) engine or to a remote logstash.

This is a go package, but the ES developers are using layers upon layers
of abstractions to try and fail to provide an easier build mechanism.

First, they use a convoluted set of Makefiles to wrap a lot of arcane
commands. There is no obvious way to follow what's going on, especially
as...

... second they use mage [0] as a first layer to abstract 'go build',
but mage really does not play nicely in cross-compilation; it is a PITA
to use, and it very easily gets confused. Building natively is also very
fragile and heavily dependent on the user's environment (env, path,
tools versions...), which makes it fails quite easily and
spectacularly...

But in the end, a simple "go build" works like a charm to build the
beats' executable. This means we can just use Buildroot's golang-package
infrastructure. Wee!

However, there does not seem to be actual commands to generate the
dataset (like the modules definitions or the kibana dashboards) from
source (they basically are YAML descriptions, but they need to be
aggregated in a special way, not just concatenated); even running the
Makefile as described in the documentation for a native build does not
produce those modules...

To work around this issue, we just grab the release tarball, and copy
all the data from it. This is an ugly workaround, indeed, but this is
the best we can do before our mental health degrades beyond hope...

On AArch64, the link may fail with errors like:

    [...]
    github.com/elastic/beats/v7/filebeat
    # github.com/elastic/beats/v7/filebeat
    [...]/output/per-package/filebeat/host/lib/go/pkg/tool/linux_amd64/link: running [...]/output/per-package/filebeat/host/bin/aarch64-linux-gcc failed: exit status 1
    collect2: fatal error: cannot find ‘ld’
    compilation terminated.

The error happens because go, on AArch64, will forcibly want to use
ld.gold, as a workaround for a alleged binutils breakage:
    https://github.com/golang/go/commit/3c8d6af8e02bbf230c2bef9f181d8ea393068299
    https://github.com/golang/go/issues/22040
    https://go-review.googlesource.com/c/go/+/22141
    https://sourceware.org/bugzilla/show_bug.cgi?id=19962

This is supposedly fixed in binutils 2.36, but go still wants to use
ld.gold. As not all toolchains have gold, force use of ld.bfd, which in
practice has been shown to work correctly with recent-ish binutils
versions: the link succeeds, and the program runs. This may still break
on older toolchains, especially those with older binutils that did not
have ld.gold (so they would not have ld.bfd either, just ld), but better
have breakage on older toolchains, for which there's not much we can do,
than on newer ones.

(the same issue also occurred for ARM, but the ld.gold requirement was
dropped in cd77738198ff, first included in go 1.21, which is now what we
use in Buildroot)

On riscv64, the build fails because of missing atomic ints:
    github.com/elastic/beats/v7/libbeat/statestore
    github.com/elastic/beats/v7/filebeat/inputsource/common/streaming
    # github.com/elastic/beats/v7/libbeat/statestore
    libbeat/statestore/store.go:28:18: undefined: atomic.Int
    libbeat/statestore/store.go:48:20: undefined: atomic.MakeInt
    github.com/elastic/beats/v7/libbeat/processors/ratelimit
    github.com/elastic/beats/v7/filebeat/input/kafka
    # github.com/elastic/beats/v7/filebeat/inputsource/common/streaming
    filebeat/inputsource/common/streaming/listener.go:48:25: undefined: atomic.Int
    # github.com/elastic/beats/v7/libbeat/processors/ratelimit
    libbeat/processors/ratelimit/token_bucket.go:53:20: undefined: atomic.Uint
    libbeat/processors/ratelimit/token_bucket.go:96:21: undefined: atomic.Uint
    libbeat/processors/ratelimit/token_bucket.go:193:34: undefined: atomic.MakeUint
    # github.com/elastic/beats/v7/filebeat/input/kafka
    filebeat/input/kafka/input.go:395:23: undefined: atomic.MakeInt

That's because beats reimplement/wrap atomic ints, but the file
implementing those is not whitelisted for riscv64 (yes, 7.0 because this
is what kafka's input module imports even in 8.2.2):
    https://github.com/elastic/beats/blame/7.0/libbeat/common/atomic/atomic64.go#L18

and it has still not changed in 8.2.2 anyway:
    https://github.com/elastic/beats/blame/v8.2.2/libbeat/common/atomic/atomic64.go#L18

(thanks to Vincent Fazzio for pointing this out.)

Finally, we only package version 8.8.2, because any later version can't
be vendored, see: https://github.com/elastic/beats/issues/36949

[0] https://magefile.org/

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Vincent Fazio <vfazio@gmail.com>
---
 package/Config.in                 |  1 +
 package/filebeat/Config.in        | 14 +++++
 package/filebeat/filebeat.default |  1 +
 package/filebeat/filebeat.hash    |  5 ++
 package/filebeat/filebeat.mk      | 85 +++++++++++++++++++++++++++++++
 package/filebeat/filebeat.service | 13 +++++
 package/filebeat/filebeat.yml     |  5 ++
 7 files changed, 124 insertions(+)
 create mode 100644 package/filebeat/Config.in
 create mode 100644 package/filebeat/filebeat.default
 create mode 100644 package/filebeat/filebeat.hash
 create mode 100644 package/filebeat/filebeat.mk
 create mode 100644 package/filebeat/filebeat.service
 create mode 100644 package/filebeat/filebeat.yml

Comments

Nathaniel Roach Nov. 2, 2023, 8:53 a.m. UTC | #1 
On 30/10/23 17:22, yann.morin@orange.com wrote:

> From: "Yann E. MORIN" <yann.morin@orange.com>
>
> filebeat is one of the many Elastic 'beats' that can send data to a
> remote ElasticSearch (ES) engine or to a remote logstash.
>
> This is a go package, but the ES developers are using layers upon layers
> of abstractions to try and fail to provide an easier build mechanism.
>
> First, they use a convoluted set of Makefiles to wrap a lot of arcane
> commands. There is no obvious way to follow what's going on, especially
> as...
>
> ... second they use mage [0] as a first layer to abstract 'go build',
> but mage really does not play nicely in cross-compilation; it is a PITA
> to use, and it very easily gets confused. Building natively is also very
> fragile and heavily dependent on the user's environment (env, path,
> tools versions...), which makes it fails quite easily and
> spectacularly...
>
> But in the end, a simple "go build" works like a charm to build the
> beats' executable. This means we can just use Buildroot's golang-package
> infrastructure. Wee!
>
> However, there does not seem to be actual commands to generate the
> dataset (like the modules definitions or the kibana dashboards) from
> source (they basically are YAML descriptions, but they need to be
> aggregated in a special way, not just concatenated); even running the
> Makefile as described in the documentation for a native build does not
> produce those modules...
>
> To work around this issue, we just grab the release tarball, and copy
> all the data from it. This is an ugly workaround, indeed, but this is
> the best we can do before our mental health degrades beyond hope...
>
> On AArch64, the link may fail with errors like:
>
>      [...]
>      github.com/elastic/beats/v7/filebeat
>      # github.com/elastic/beats/v7/filebeat
>      [...]/output/per-package/filebeat/host/lib/go/pkg/tool/linux_amd64/link: running [...]/output/per-package/filebeat/host/bin/aarch64-linux-gcc failed: exit status 1
>      collect2: fatal error: cannot find ‘ld’
>      compilation terminated.
>
> The error happens because go, on AArch64, will forcibly want to use
> ld.gold, as a workaround for a alleged binutils breakage:
>      https://github.com/golang/go/commit/3c8d6af8e02bbf230c2bef9f181d8ea393068299
>      https://github.com/golang/go/issues/22040
>      https://go-review.googlesource.com/c/go/+/22141
>      https://sourceware.org/bugzilla/show_bug.cgi?id=19962
>
> This is supposedly fixed in binutils 2.36, but go still wants to use
> ld.gold. As not all toolchains have gold, force use of ld.bfd, which in
> practice has been shown to work correctly with recent-ish binutils
> versions: the link succeeds, and the program runs. This may still break
> on older toolchains, especially those with older binutils that did not
> have ld.gold (so they would not have ld.bfd either, just ld), but better
> have breakage on older toolchains, for which there's not much we can do,
> than on newer ones.
>
> (the same issue also occurred for ARM, but the ld.gold requirement was
> dropped in cd77738198ff, first included in go 1.21, which is now what we
> use in Buildroot)
>
> On riscv64, the build fails because of missing atomic ints:
>      github.com/elastic/beats/v7/libbeat/statestore
>      github.com/elastic/beats/v7/filebeat/inputsource/common/streaming
>      # github.com/elastic/beats/v7/libbeat/statestore
>      libbeat/statestore/store.go:28:18: undefined: atomic.Int
>      libbeat/statestore/store.go:48:20: undefined: atomic.MakeInt
>      github.com/elastic/beats/v7/libbeat/processors/ratelimit
>      github.com/elastic/beats/v7/filebeat/input/kafka
>      # github.com/elastic/beats/v7/filebeat/inputsource/common/streaming
>      filebeat/inputsource/common/streaming/listener.go:48:25: undefined: atomic.Int
>      # github.com/elastic/beats/v7/libbeat/processors/ratelimit
>      libbeat/processors/ratelimit/token_bucket.go:53:20: undefined: atomic.Uint
>      libbeat/processors/ratelimit/token_bucket.go:96:21: undefined: atomic.Uint
>      libbeat/processors/ratelimit/token_bucket.go:193:34: undefined: atomic.MakeUint
>      # github.com/elastic/beats/v7/filebeat/input/kafka
>      filebeat/input/kafka/input.go:395:23: undefined: atomic.MakeInt
>
> That's because beats reimplement/wrap atomic ints, but the file
> implementing those is not whitelisted for riscv64 (yes, 7.0 because this
> is what kafka's input module imports even in 8.2.2):
>      https://github.com/elastic/beats/blame/7.0/libbeat/common/atomic/atomic64.go#L18
>
> and it has still not changed in 8.2.2 anyway:
>      https://github.com/elastic/beats/blame/v8.2.2/libbeat/common/atomic/atomic64.go#L18
>
> (thanks to Vincent Fazzio for pointing this out.)
>
> Finally, we only package version 8.8.2, because any later version can't
> be vendored, see: https://github.com/elastic/beats/issues/36949
>
> [0] https://magefile.org/
>
> Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
> Cc: Vincent Fazio <vfazio@gmail.com>
> ---
>   package/Config.in                 |  1 +
>   package/filebeat/Config.in        | 14 +++++
>   package/filebeat/filebeat.default |  1 +
>   package/filebeat/filebeat.hash    |  5 ++
>   package/filebeat/filebeat.mk      | 85 +++++++++++++++++++++++++++++++
>   package/filebeat/filebeat.service | 13 +++++
>   package/filebeat/filebeat.yml     |  5 ++
>   7 files changed, 124 insertions(+)
>   create mode 100644 package/filebeat/Config.in
>   create mode 100644 package/filebeat/filebeat.default
>   create mode 100644 package/filebeat/filebeat.hash
>   create mode 100644 package/filebeat/filebeat.mk
>   create mode 100644 package/filebeat/filebeat.service
>   create mode 100644 package/filebeat/filebeat.yml
>
> diff --git a/package/Config.in b/package/Config.in
> index 4e489c4706..11deb7ccee 100644
> --- a/package/Config.in
> +++ b/package/Config.in
> @@ -2350,6 +2350,7 @@ endif
>   	source "package/fail2ban/Config.in"
>   	source "package/fastd/Config.in"
>   	source "package/fcgiwrap/Config.in"
> +	source "package/filebeat/Config.in"
>   	source "package/firewalld/Config.in"
>   	source "package/flannel/Config.in"
>   	source "package/fmc/Config.in"
> diff --git a/package/filebeat/Config.in b/package/filebeat/Config.in
> new file mode 100644
> index 0000000000..78adae11cd
> --- /dev/null
> +++ b/package/filebeat/Config.in
> @@ -0,0 +1,14 @@
> +config BR2_PACKAGE_FILEBEAT
> +	bool "filebeat"
> +	depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
> +	depends on !BR2_RISCV_64
> +	help
> +	  Lightweight data shippers
> +
> +	  Beats is a free and open platform for single-purpose data
> +	  shippers. They send data from hundreds or thousands of
> +	  machines and systems to Logstash or Elasticsearch.
> +
> +	  This package only installs filebeat.
> +
> +	  https://www.elastic.co/products/beats
> diff --git a/package/filebeat/filebeat.default b/package/filebeat/filebeat.default
> new file mode 100644
> index 0000000000..ab51c81018
> --- /dev/null
> +++ b/package/filebeat/filebeat.default
> @@ -0,0 +1 @@
> +FILEBEAT_OPTS=-c /etc/filebeat/filebeat.yml
> diff --git a/package/filebeat/filebeat.hash b/package/filebeat/filebeat.hash
> new file mode 100644
> index 0000000000..11a86f81f2
> --- /dev/null
> +++ b/package/filebeat/filebeat.hash
> @@ -0,0 +1,5 @@
> +# Locally computed
> +sha256  713d109760bbdfcdb30651861bd3899945114325ed65cb2bd744d7ff02c399a9  filebeat-8.8.2.tar.gz
> +sha256  23e50a1dead216922519026a878d3c75cc2860eb4ca6de186ac64100f85623f3  filebeat-8.8.2-linux-x86_64.tar.gz
> +sha256  7f0eb504dd0b8b090b52cff384296249be3168374f271b142ce03130c987c8e5  LICENSE.txt
> +sha256  928b3ded5ea8db33fadb8e5bea8bb10e1f79d2a904e9c97745f54b57e6a1588b  NOTICE.txt
> diff --git a/package/filebeat/filebeat.mk b/package/filebeat/filebeat.mk
> new file mode 100644
> index 0000000000..02cc8d917f
> --- /dev/null
> +++ b/package/filebeat/filebeat.mk
> @@ -0,0 +1,85 @@
> +################################################################################
> +#
> +# filebeat
> +#
> +################################################################################
> +
> +# When updating, regenerate the list of licenses, below
> +FILEBEAT_VERSION = 8.8.2
> +FILEBEAT_SITE = $(call github,elastic,beats,v$(FILEBEAT_VERSION))
> +FILEBEAT_DL_SUBDIR = elastic-beats
> +FILEBEAT_EXTRA_SITE = https://artifacts.elastic.co/downloads/beats/filebeat
> +FILEBEAT_EXTRA_SOURCE = filebeat-$(FILEBEAT_VERSION)-linux-x86_64.tar.gz
> +FILEBEAT_EXTRA_DOWNLOADS = $(FILEBEAT_EXTRA_SITE)/$(FILEBEAT_EXTRA_SOURCE)
> +
> +# License list obtained with:
> +#   sed -r -e '/^Licence type.*: (.+)$/!d; s//\1/;' NOTICE.txt |sort -u
> +FILEBEAT_LICENSE = \
> +	Apache-2.0, \
> +	BSD, \
> +	BSD-2-Clause, \
> +	BSD-2-Clause-FreeBSD, \
> +	BSD-3-Clause, \
> +	Elastic, \
> +	ISC, \
> +	MIT, \
> +	MPL-2.0
> +
> +FILEBEAT_LICENSE_FILES = LICENSE.txt NOTICE.txt
> +
> +FILEBEAT_GOMOD = github.com/elastic/beats/v7
> +FILEBEAT_BUILD_TARGETS = filebeat
> +
> +ifeq ($(BR2_arm)$(BR2_aarch64),y)
> +# On aarch64, go will forcibly use gold, on the assumption that ld.bfd is
> +# broken, but that is supposedly fixed on binutils master, and at least
> +# released in 2.36 onward. So, we force it back to use ld.bfd, as not all
> +# toolchains have ld.gold (for example, the Bootlin toolchians, built with
> +# Buildroot, do not).
> +FILEBEAT_EXTLDFLAGS += -fuse-ld=bfd
> +endif
> +
> +FILEBEAT_PREBUILT_MODULES_DIR = $(@D)/.elastic-pre-built-for-modules
> +
> +# We extract the pre-built release of filebeat, just for the modules
> +# and stuff (building those from the actual source tree seems to be
> +# so arcanne that it is not documented anywhere). Modules are but
> +# a large collection of yaml and json files, though.
> +define FILEBEAT_EXTRACT_MODULES
> +	$(Q)mkdir -p $(FILEBEAT_PREBUILT_MODULES_DIR)
> +	$(Q)$(call suitable-extractor,$(FILEBEAT_EXTRA_SOURCE)) \
> +		$(FILEBEAT_DL_DIR)/$(FILEBEAT_EXTRA_SOURCE) \
> +	|$(TAR) --strip-components=1 \
> +		-C $(FILEBEAT_PREBUILT_MODULES_DIR) \
> +		$(TAR_OPTIONS) -
> +endef
> +FILEBEAT_POST_EXTRACT_HOOKS += FILEBEAT_EXTRACT_MODULES
> +
> +# This layout mirrors the one in the .deb released by Elastic
> +define FILEBEAT_INSTALL_MODULES
> +	$(Q)mkdir -p $(TARGET_DIR)/etc/filebeat $(TARGET_DIR)/usr/share/filebeat
> +	cp -a \
> +		$(FILEBEAT_PREBUILT_MODULES_DIR)/fields.yml \
> +		$(FILEBEAT_PREBUILT_MODULES_DIR)/modules.d \
> +		$(TARGET_DIR)/etc/filebeat/
> +	cp -a \
> +		$(FILEBEAT_PREBUILT_MODULES_DIR)/kibana \
> +		$(FILEBEAT_PREBUILT_MODULES_DIR)/module \
> +		$(TARGET_DIR)/usr/share/filebeat/
> +endef
> +FILEBEAT_POST_INSTALL_TARGET_HOOKS += FILEBEAT_INSTALL_MODULES
> +
> +define FILEBEAT_INSTALL_CONFIG
> +	$(INSTALL) -D -m 0644 $(FILEBEAT_PKGDIR)/filebeat.yml \
> +		$(TARGET_DIR)/etc/filebeat/filebeat.yml
> +	$(INSTALL) -D -m 0644 $(FILEBEAT_PKGDIR)/filebeat.default \
> +		$(TARGET_DIR)/etc/default/filebeat
> +endef
> +FILEBEAT_POST_INSTALL_TARGET_HOOKS += FILEBEAT_INSTALL_CONFIG
> +
> +define FILEBEAT_INSTALL_INIT_SYSTEMD
> +	$(INSTALL) -D -m 0644 $(FILEBEAT_PKGDIR)/filebeat.service \
> +		$(TARGET_DIR)/usr/lib/systemd/system/filebeat.service
> +endef
> +
> +$(eval $(golang-package))
> diff --git a/package/filebeat/filebeat.service b/package/filebeat/filebeat.service
> new file mode 100644
> index 0000000000..08234f50b6
> --- /dev/null
> +++ b/package/filebeat/filebeat.service
> @@ -0,0 +1,13 @@
> +[Unit]
> +Description=Filebeat
> +Wants=network-online.target
> +After=network-online.target
> +
> +[Service]
> +UMask=0027
> +EnvironmentFile=/etc/default/filebeat
> +ExecStart=/usr/bin/filebeat --environment systemd $FILEBEAT_OPTS
> +Restart=always
> +
> +[Install]
> +WantedBy=multi-user.target
> diff --git a/package/filebeat/filebeat.yml b/package/filebeat/filebeat.yml
> new file mode 100644
> index 0000000000..147c1d55dd
> --- /dev/null
> +++ b/package/filebeat/filebeat.yml
> @@ -0,0 +1,5 @@
> +path:
> +    home: /usr/share/filebeat
> +    config: /etc/filebeat
> +    data: /var/lib/filebeat
> +    logs: /var/log/filebeat
Tested-by: Nathaniel Roach <nroach44@nroach44.id.au>

As noted in IRC, /etc/filebeat/*.disabled files are just configuration 
examples / templates and can be ignored. /usr/share/filebeat files look 
to be a kind of dashboard schema for Kibana, and are probably (?) safe 
to exclude as well.
diff mbox series

Patch

diff --git a/package/Config.in b/package/Config.in
index 4e489c4706..11deb7ccee 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -2350,6 +2350,7 @@  endif
 	source "package/fail2ban/Config.in"
 	source "package/fastd/Config.in"
 	source "package/fcgiwrap/Config.in"
+	source "package/filebeat/Config.in"
 	source "package/firewalld/Config.in"
 	source "package/flannel/Config.in"
 	source "package/fmc/Config.in"
diff --git a/package/filebeat/Config.in b/package/filebeat/Config.in
new file mode 100644
index 0000000000..78adae11cd
--- /dev/null
+++ b/package/filebeat/Config.in
@@ -0,0 +1,14 @@ 
+config BR2_PACKAGE_FILEBEAT
+	bool "filebeat"
+	depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
+	depends on !BR2_RISCV_64
+	help
+	  Lightweight data shippers
+
+	  Beats is a free and open platform for single-purpose data
+	  shippers. They send data from hundreds or thousands of
+	  machines and systems to Logstash or Elasticsearch.
+
+	  This package only installs filebeat.
+
+	  https://www.elastic.co/products/beats
diff --git a/package/filebeat/filebeat.default b/package/filebeat/filebeat.default
new file mode 100644
index 0000000000..ab51c81018
--- /dev/null
+++ b/package/filebeat/filebeat.default
@@ -0,0 +1 @@ 
+FILEBEAT_OPTS=-c /etc/filebeat/filebeat.yml
diff --git a/package/filebeat/filebeat.hash b/package/filebeat/filebeat.hash
new file mode 100644
index 0000000000..11a86f81f2
--- /dev/null
+++ b/package/filebeat/filebeat.hash
@@ -0,0 +1,5 @@ 
+# Locally computed
+sha256  713d109760bbdfcdb30651861bd3899945114325ed65cb2bd744d7ff02c399a9  filebeat-8.8.2.tar.gz
+sha256  23e50a1dead216922519026a878d3c75cc2860eb4ca6de186ac64100f85623f3  filebeat-8.8.2-linux-x86_64.tar.gz
+sha256  7f0eb504dd0b8b090b52cff384296249be3168374f271b142ce03130c987c8e5  LICENSE.txt
+sha256  928b3ded5ea8db33fadb8e5bea8bb10e1f79d2a904e9c97745f54b57e6a1588b  NOTICE.txt
diff --git a/package/filebeat/filebeat.mk b/package/filebeat/filebeat.mk
new file mode 100644
index 0000000000..02cc8d917f
--- /dev/null
+++ b/package/filebeat/filebeat.mk
@@ -0,0 +1,85 @@ 
+################################################################################
+#
+# filebeat
+#
+################################################################################
+
+# When updating, regenerate the list of licenses, below
+FILEBEAT_VERSION = 8.8.2
+FILEBEAT_SITE = $(call github,elastic,beats,v$(FILEBEAT_VERSION))
+FILEBEAT_DL_SUBDIR = elastic-beats
+FILEBEAT_EXTRA_SITE = https://artifacts.elastic.co/downloads/beats/filebeat
+FILEBEAT_EXTRA_SOURCE = filebeat-$(FILEBEAT_VERSION)-linux-x86_64.tar.gz
+FILEBEAT_EXTRA_DOWNLOADS = $(FILEBEAT_EXTRA_SITE)/$(FILEBEAT_EXTRA_SOURCE)
+
+# License list obtained with:
+#   sed -r -e '/^Licence type.*: (.+)$/!d; s//\1/;' NOTICE.txt |sort -u
+FILEBEAT_LICENSE = \
+	Apache-2.0, \
+	BSD, \
+	BSD-2-Clause, \
+	BSD-2-Clause-FreeBSD, \
+	BSD-3-Clause, \
+	Elastic, \
+	ISC, \
+	MIT, \
+	MPL-2.0
+
+FILEBEAT_LICENSE_FILES = LICENSE.txt NOTICE.txt
+
+FILEBEAT_GOMOD = github.com/elastic/beats/v7
+FILEBEAT_BUILD_TARGETS = filebeat
+
+ifeq ($(BR2_arm)$(BR2_aarch64),y)
+# On aarch64, go will forcibly use gold, on the assumption that ld.bfd is
+# broken, but that is supposedly fixed on binutils master, and at least
+# released in 2.36 onward. So, we force it back to use ld.bfd, as not all
+# toolchains have ld.gold (for example, the Bootlin toolchians, built with
+# Buildroot, do not).
+FILEBEAT_EXTLDFLAGS += -fuse-ld=bfd
+endif
+
+FILEBEAT_PREBUILT_MODULES_DIR = $(@D)/.elastic-pre-built-for-modules
+
+# We extract the pre-built release of filebeat, just for the modules
+# and stuff (building those from the actual source tree seems to be
+# so arcanne that it is not documented anywhere). Modules are but
+# a large collection of yaml and json files, though.
+define FILEBEAT_EXTRACT_MODULES
+	$(Q)mkdir -p $(FILEBEAT_PREBUILT_MODULES_DIR)
+	$(Q)$(call suitable-extractor,$(FILEBEAT_EXTRA_SOURCE)) \
+		$(FILEBEAT_DL_DIR)/$(FILEBEAT_EXTRA_SOURCE) \
+	|$(TAR) --strip-components=1 \
+		-C $(FILEBEAT_PREBUILT_MODULES_DIR) \
+		$(TAR_OPTIONS) -
+endef
+FILEBEAT_POST_EXTRACT_HOOKS += FILEBEAT_EXTRACT_MODULES
+
+# This layout mirrors the one in the .deb released by Elastic
+define FILEBEAT_INSTALL_MODULES
+	$(Q)mkdir -p $(TARGET_DIR)/etc/filebeat $(TARGET_DIR)/usr/share/filebeat
+	cp -a \
+		$(FILEBEAT_PREBUILT_MODULES_DIR)/fields.yml \
+		$(FILEBEAT_PREBUILT_MODULES_DIR)/modules.d \
+		$(TARGET_DIR)/etc/filebeat/
+	cp -a \
+		$(FILEBEAT_PREBUILT_MODULES_DIR)/kibana \
+		$(FILEBEAT_PREBUILT_MODULES_DIR)/module \
+		$(TARGET_DIR)/usr/share/filebeat/
+endef
+FILEBEAT_POST_INSTALL_TARGET_HOOKS += FILEBEAT_INSTALL_MODULES
+
+define FILEBEAT_INSTALL_CONFIG
+	$(INSTALL) -D -m 0644 $(FILEBEAT_PKGDIR)/filebeat.yml \
+		$(TARGET_DIR)/etc/filebeat/filebeat.yml
+	$(INSTALL) -D -m 0644 $(FILEBEAT_PKGDIR)/filebeat.default \
+		$(TARGET_DIR)/etc/default/filebeat
+endef
+FILEBEAT_POST_INSTALL_TARGET_HOOKS += FILEBEAT_INSTALL_CONFIG
+
+define FILEBEAT_INSTALL_INIT_SYSTEMD
+	$(INSTALL) -D -m 0644 $(FILEBEAT_PKGDIR)/filebeat.service \
+		$(TARGET_DIR)/usr/lib/systemd/system/filebeat.service
+endef
+
+$(eval $(golang-package))
diff --git a/package/filebeat/filebeat.service b/package/filebeat/filebeat.service
new file mode 100644
index 0000000000..08234f50b6
--- /dev/null
+++ b/package/filebeat/filebeat.service
@@ -0,0 +1,13 @@ 
+[Unit]
+Description=Filebeat
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+UMask=0027
+EnvironmentFile=/etc/default/filebeat
+ExecStart=/usr/bin/filebeat --environment systemd $FILEBEAT_OPTS
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
diff --git a/package/filebeat/filebeat.yml b/package/filebeat/filebeat.yml
new file mode 100644
index 0000000000..147c1d55dd
--- /dev/null
+++ b/package/filebeat/filebeat.yml
@@ -0,0 +1,5 @@ 
+path:
+    home: /usr/share/filebeat
+    config: /etc/filebeat
+    data: /var/lib/filebeat
+    logs: /var/log/filebeat