#get_mik_ips.py
from ast import literal_eval
import json
from pyzabbix import ZabbixAPI
zapi = ZabbixAPI("http://zabbix.sogaz-med.ru/zabbix")
zapi.login("login", "password")
myfile = open ('/usr/scripts/mik_strs', 'w')
myfile.write( " if [host] in [\"10.1.1.254\"")
for host in zapi.host.get(output = ['hostid','host'], selectInterfaces=['ip'],groupids=[65]):
  myfile.write(", \""+host['interfaces'][0]['ip']+ "\"")
myfile.write( "]{" +'\n')
#------------------------------
Вот так выглядит /etc/logstash/conf.d/filter.conf до первой работы анзибля
filter {
#MIKMIKMIK
        mutate {
            add_tag => [ "mikrotik"]
        }
 }

 date {
        match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
 }
}
----------------------------------
#playbook
- hosts: localhost
  tasks:
   - name: get ips from zabbix
     ansible.builtin.script: /usr/scripts/get_mik_ips.py

   - name: get lostash string from file
     ansible.builtin.shell: cat /usr/scripts/mik_strs
     register: logstash_str

- hosts: LogServer
  become: true
  become_method: su
  become_user: root

  tasks:
   - name: add block to logstash
     blockinfile:
       path: /etc/logstash/conf.d/filter.conf
       insertafter: "#MIKMIKMIK"
       block: |
         {{ hostvars['localhost']['logstash_str'].stdout_lines[0] }}
     register: logstash_conf
   - name: restart logstash
     ansible.builtin.shell:  systemctl restart logstash.service
     when: logstash_conf.changed
-------------------------------
#включит отсылку логов на всех микротиках
- hosts: Mikrotiks-test
  vars_files:
    - /etc/ansible/vars/new_mik_pass_vault.yml
  connection: network_cli
  gather_facts: false
  tasks:
    - set_fact: command_line="action set 3 remote=10.222.180.100 remote-port=5045 src-address= {{ inventory_hostname }}"
    - name: do command
      routeros_command:
        commands:
          - /system logging {{ command_line }}