Configure Elastic Stack Step-by-Step¶

Normally, you use the load-config script provided by SEAL Systems for configuring Elastic Stack, refer to Configure Elastic Stack.

However, you can also execute the configuration step-by-step via the Kibana user interface as described here.

Stop the seal-filebeat services on all PLOSSYS 5 servers (if already installed) so that no new data will be sent to Elasticsearch:
```
plossys service stop seal-filebeat
```
Open the Kibana user interface:
```
http://<admin_server>:5601
```
In order to focus on the index management, collapse some parts of the menu and select Dock navigation:
Delete the old indices (seal-plossys-5-log, seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting, seal-easyprima-audit) due to these were created by seal-filebeat by default:
Create the index lifecycle policies for the seal-plossys-5-log index and specify the following settings. Repeat the steps for seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting and seal-easyprima-audit correspondingly if desired:
- In Policy name, specify the name of the policy. Although the policy name is arbitrary, we recommend using the same name as for the index (seal-plossys-5-log)
- In the Hot phase section, expand Advanced settings, switch off Use recommended defaults and specify Maximum primary shard size. We recommend 10 GB.
  
  Hint - deprecated
  
  As of SEAL Elastic Stack 7.16.0.53, the previously used setting Maximum index size is deprecated and will be removed in one of the next versions. For more information, refer to Elastic Stack.
- Switch on the Delete phase section by clicking the trash icon and specify a time in Move data into phase when. We recommend 7 days.

Create the index template for the seal-plossys-5-log index and specify the following settings. Repeat the steps for seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting and seal-easyprima-audit correspondingly if desired:

Create Template 1

In the Logistics tab, specify Name. We recommend using the same name as for the index (seal-plossys-5-log).
In Index patterns, specify the name of the index followed by -* (seal-plossys-5-log-*).
In the Component templates tab, nothing has to be specified:

In the Index settings tab, enter the following JSON object. The JSON object given below corresponds to the seal-plossys-5-log index template. Adjust the JSON object for the other index templates correspondingly:

{
  "index": {
    "lifecycle": {
      "name": "seal-plossys-5-log",
      "rollover_alias": "seal-plossys-5-log"
    },
    "mapping": {
      "total_fields": {
        "limit": "2000"
      }
    }
  }
}

Create Template 4

In the Mappings tab, you specify different items depending on the index template currently being configured:

For seal-plossys-5-log, click Load JSON and enter the following JSON object:

{
  "properties": {
    "metadata": {
      "properties": {
        "jobId": {
          "type": "keyword"
        },
        "jobProperties": {
          "type": "object"
        },
        "printer": {
          "type": "keyword"
        },
        "psProperties": {
          "type": "flattened",
          "ignore_above": 8191
        }
      }
    }
  }
}

Create Template 5

For seal-plossys-5-accounting, click Load JSON and enter the following JSON object:

{
  "properties": {
    "accounting": {
      "properties": {
        "metadata": {
          "properties": {
            "jobID": {
              "type": "keyword"
            }
          }
        },
        "principal": {
          "properties": {
            "deviceID": {
              "type": "keyword"
            },
            "printer": {
              "type": "keyword"
            },
            "userID": {
              "type": "keyword"
            }
          }
        },
        "resources": {
          "properties": {
            "inputPages": {
              "type": "nested"
            }
          }
        }
      }
    }
  }
}

Create Template 7

For seal-plossys-5-statistics and seal-plossys-5-audit, nothing has to be specified:

In the Aliases tab, nothing has to be specified:
In the Review template tab, click Create template.

Create the write aliases for the seal-plossys-5-log index. Repeat the steps for seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting and seal-easyprima-audit correspondingly if desired:
- In the Console tab, enter the following code for the seal-plossys-5-log index into the left column. Adjust the code for the other index templates correspondingly. Afterwards, click the arrow button:
```
PUT seal-plossys-5-log-000001
{
  "aliases": {
    "seal-plossys-5-log": {
      "is_write_index": true
    }
  }
}
```
Check the list of the indices. The Index Management list now contains the indices you have configured so far:
Start the seal-filebeat services on all PLOSSYS 5 servers (if already installed):
```
plossys service start seal-filebeat
```

Create the Index Pattern for the Audit Indices¶

For the seal-plossys-5-audit index, you have to create an index pattern. Repeat the steps for seal-easyprima-audit correspondingly if desired:

Change to Index Patterns in the Kibana section and click Create index pattern.
While typing seal-plossys-5-audit in Index pattern name, the list below shrinks to the fitting indices:
Proceed to the next step:
Select @timestamp from the list of available fields for refreshing the data and click Create index pattern:

Optionally, click on Show advanced settings, enter seal-plossys-5-audit as Custom index pattern ID and click Create index pattern:
In the overview, you can select the seal-plossys-5-audit index pattern now:
The audit data is listed and you can configure the view:

Update a Dashboard for Kibana¶

Normally, you run the load-config script for creating a new dashboard for Kibana. The dashboard visualizes the data from the Elasticsearch index seal-plossys-5-log.

In order to use the dashboard both with the combination of PLOSSYS 5.3.3 and Elastic Stack 7.6.2 and the combination PLOSSYS 5.3.4 and Elastic Stack 7.13.4, you have to modify the already existent seal-plossys-5-log index template or create a new one. The versions differ in the configuration of the Mappings tab, refer to the JSON object listed below.

The previous index template can be found via the Kibana user interface in the Legacy index templates section and deleted if desired:

Delete Legacy Template

For updating the existent index template for the new dashboard manually, open the Kibana user interface and edit the existent seal-plossys-5-log index template:

Edit Index Template

In the Mappings tab, click Load JSON and enter the JSON object described in the section above:

{
  "properties": {
    "metadata": {
      "properties": {
        "jobId": {
          "type": "keyword"
        },
        "jobProperties": {
          "type": "object"
        },
        "printer": {
          "type": "keyword"
        },
        "psProperties": {
          "type": "flattened",
          "ignore_above": 8191
        }
      }
    }
  }
}

Edit Log Index Template

In the Review template tab, click Save template:

Save Log Index Template