Configuring SEAL Elastic Stack by Hand¶

You can configure SEAL Elastic Stack step-by-step via the Kibana user interface.

Standard Configuration Method

We recommend you use the load-config script provided by SEAL Systems for the configuration of SEAL Elasticsearch.

For details on this, refer to Configuring SEAL Elastic Stack via Script.

Instructions¶

Stop the seal-filebeat services on all PLOSSYS 5 servers to stop the data transfer to Elasticsearch:
```
sudo systemctl stop seal-filebeat
```
Open the Kibana user interface:
```
http://<admin_server>:5601
```
Collapse unnecessary parts of the menu for a better overview and select Dock navigation:
Delete the old indices (seal-plossys-5-log, seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting, seal-easyprima-audit) due to these were created by seal-filebeat by default:
Create the index lifecycle policies for the seal-plossys-5-log index and specify the settings as shown in the following screenshot.

Repeat the steps for seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting and seal-easyprima-audit, if desired.
- In Policy name, specify the name of the policy. Although the policy name is arbitrary, we recommend using the same name as for the index, here seal-plossys-5-log.
- In the Hot phase section, expand Advanced settings, switch off Use recommended defaults and specify Maximum primary shard size. We recommend 10 GB.
  
  Hint - deprecated
  
  As of SEAL Elastic Stack 7.16.0.53, the previously used setting Maximum index size is deprecated and will be removed in one of the next versions. For more information, refer to Elastic Stack.
- Switch on the Delete phase section by clicking the trash icon and specify the desired time in Move data into phase when. We recommend 7 days.

Create the index template for the seal-plossys-5-log index and specify the settings as shown in the following screenshot.

Repeat the steps for seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting and seal-easyprima-audit, if desired.

Create Template 1

In the Logistics tab, specify Name. We recommend using the same name as for the index, here seal-plossys-5-log.
In Index patterns, specify the name of the index followed by -*, here seal-plossys-5-log-*.
Leave the Component templates tab unchanged:
In the Index settings tab, enter the JSON object as shown in the following screenshot.

The JSON object given here belongs to the seal-plossys-5-log index template. Repeat the steps for seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting and seal-easyprima-audit, if desired.
```
{
  "index": {
    "lifecycle": {
      "name": "seal-plossys-5-log",
      "rollover_alias": "seal-plossys-5-log"
    },
    "mapping": {
      "total_fields": {
        "limit": "2000"
      }
    }
  }
}
```

In the Mappings tab, specify the reqired items. These depend on the index template you currently configure.

For seal-plossys-5-log, click Load JSON and enter the following JSON object:

{
  "properties": {
    "metadata": {
      "properties": {
        "jobId": {
          "type": "keyword"
        },
        "jobProperties": {
          "type": "object"
        },
        "printer": {
          "type": "keyword"
        },
        "psProperties": {
          "type": "flattened",
          "ignore_above": 8191
        }
      }
    }
  }
}

Create Template 5

For seal-plossys-5-accounting, click Load JSON and enter the following JSON object:

{
  "properties": {
    "accounting": {
      "properties": {
        "metadata": {
          "properties": {
            "jobID": {
              "type": "keyword"
            }
          }
        },
        "principal": {
          "properties": {
            "deviceID": {
              "type": "keyword"
            },
            "printer": {
              "type": "keyword"
            },
            "userID": {
              "type": "keyword"
            }
          }
        },
        "resources": {
          "properties": {
            "inputPages": {
              "type": "nested"
            }
          }
        }
      }
    }
  }
}

Create Template 7

seal-plossys-5-statistics and seal-plossys-5-audit do not require any JSON objects:

Leave the Aliases tab unchanged:
In the Review template tab, click Create template:

Create the write aliases for the seal-plossys-5-log index.

Repeat the steps for seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting and seal-easyprima-audit, if desired:
- In the Console tab, enter the code for the seal-plossys-5-log index in the left column, as given below.
  
  Adjust the code for the other index templates correspondingly. Afterwards, click the arrow button:
```
PUT seal-plossys-5-log-000001
{
  "aliases": {
    "seal-plossys-5-log": {
      "is_write_index": true
    }
  }
}
```
Check the list of the indices. The Index Management list now contains the indices you have configured so far:
Start the seal-filebeat services on all PLOSSYS 5 servers:
```
sudo systemctl start seal-filebeat
```

Creating the Index Pattern for the Audit Indices¶

For the seal-plossys-5-audit index, you have to create an index pattern. Repeat the steps for seal-easyprima-audit, if desired:

In the Kibana section, change to Index Patterns and click Create index pattern.
While typing seal-plossys-5-audit in Index pattern name, the list below shrinks to the fitting indices:
Proceed to the next step:
Select @timestamp from the list of available fields for refreshing the data and click Create index pattern:

Optionally, click Show advanced settings, enter seal-plossys-5-audit as Custom index pattern ID and click Create index pattern:
In the overview, you can select the seal-plossys-5-audit index pattern now:
The audit data is listed and you can configure the view:

Updating a Dashboard for Kibana¶

Normally, you run the load-config script for creating a new dashboard for Kibana.

The dashboard visualizes the data from the Elasticsearch index, here seal-plossys-5-log.

In order to use the dashboard with both, the combination of PLOSSYS 5.3.3 and Elastic Stack 7.6.2 and the combination of PLOSSYS 5.3.4 and Elastic Stack 7.13.4, you have to modify the already existing seal-plossys-5-log index template or create a new one. The versions differ in the configuration of the Mappings tab. For details on this, refer to the JSON object listed below.

In the Legacy index templates section, you can find the previous index template via the Kibana user interface and delete it, if desired:

Delete Legacy Template

If you whish to update the existing index template for the new dashboard manually, open the Kibana user interface and edit the existing seal-plossys-5-log index template:

Edit Index Template

In the Mappings tab, click Load JSON and enter the JSON object described in the section above:

{
  "properties": {
    "metadata": {
      "properties": {
        "jobId": {
          "type": "keyword"
        },
        "jobProperties": {
          "type": "object"
        },
        "printer": {
          "type": "keyword"
        },
        "psProperties": {
          "type": "flattened",
          "ignore_above": 8191
        }
      }
    }
  }
}

Edit Log Index Template

In the Review template tab, click Save template:

Save Log Index Template