beats: check the inventory groups the outputs need before configuring

changelogs/fragments/beats_output_group_assert.yml

@@ -0,0 +1,6 @@
+bugfixes:
+  - The beats role checks the inventory before it configures anything. A Beat whose output is
+    ``logstash`` or ``elasticsearch`` takes its hosts from the matching inventory group, and a
+    missing group used to end the run while the template was being rendered, with a message that
+    named neither the variable nor the group. The run now stops beforehand and says which
+    variable is set to what and which group is missing.

roles/beats/tasks/main.yml

@@ -65,6 +65,33 @@
     - renew_ca
     - renew_beats_cert
 
+- name: Check that the inventory has the groups the Beats outputs need
+  ansible.builtin.assert:
+    that: groups[beats_output_group] | default([]) | length > 0
+    fail_msg: >-
+      {{ item.variable }} is set to "{{ item.output }}", so the hosts come from the inventory
+      group "{{ beats_output_group }}", which does not exist or is empty. Add that group to
+      your inventory.
+    quiet: true
+  vars:
+    beats_output_group: "{{ elasticstack_logstash_group_name if item.output == 'logstash' else elasticstack_elasticsearch_group_name }}"
+  loop:
+    - variable: beats_filebeat_output
+      enabled: "{{ beats_filebeat }}"
+      output: "{{ beats_filebeat_output.type | default(beats_filebeat_output) }}"
+    - variable: beats_auditbeat_output
+      enabled: "{{ beats_auditbeat }}"
+      output: "{{ beats_auditbeat_output.type | default(beats_auditbeat_output) }}"
+    - variable: beats_metricbeat_output
+      enabled: "{{ beats_metricbeat }}"
+      output: "{{ beats_metricbeat_output.type | default(beats_metricbeat_output) }}"
+  loop_control:
+    label: "{{ item.variable }}"
+  when:
+    - elasticstack_full_stack | bool
+    - item.enabled | bool
+    - item.output in ['logstash', 'elasticsearch']
+
 - name: Import Filebeat tasks
   ansible.builtin.import_tasks: filebeat.yml
   when: beats_filebeat | bool