Configuring SEAL Elastic Stack by Hand¶

You can configure SEAL Elastic Stack step-by-step via the Kibana user interface.

Standard Configuration Method

We recommend you use the load-config script provided by SEAL Systems for the configuration of SEAL Elasticsearch.

For details on this, refer to Configuring SEAL Elastic Stack via Script.

Instructions¶

Stop the seal-filebeat services on all PLOSSYS 5, PLOSSYS 4 and easyPRIMA servers to stop the data transfer to Elasticsearch:
```
sudo systemctl stop seal-filebeat
```
```
sudo systemctl stop seal-p4-accounting-filebeat
```
Open the Kibana user interface:
```
http://<admin_server>:5601
```
Collapse unnecessary parts of the menu for a better overview and select Dock navigation:
Delete the old indices (seal-plossys-5-log, seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting, seal-easyprima-audit) due to these being created by seal-filebeat by default:
Create the index lifecycle policies for the seal-plossys-5-log index and specify the settings as shown in the following screenshot.

Repeat the steps for any other index you need, i. e. seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting or seal-easyprima-audit.
- In Policy name, specify the name of the policy. Although the policy name is arbitrary, we recommend using the same name as for the index, here seal-plossys-5-log.
- In the Hot phase section, expand Advanced settings, switch off Use recommended defaults and specify Maximum primary shard size. We recommend 10 GB.
  
  Hint - deprecated
  
  As of SEAL Elastic Stack 7.16.0.53, the previously used setting Maximum index size is deprecated and will be removed in one of the next versions. For more information, refer to Elastic Stack.
- Switch on the Delete phase section by clicking the trash icon and specify the desired time in Move data into phase when. We recommend 7 days.

Create the index template for the seal-plossys-5-log index and specify the settings as shown in the following screenshot.

Repeat the steps for any other index you need, i. e. seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting or seal-easyprima-audit.

Create Template 1

In the Logistics tab, specify Name. We recommend using the same name as for the index, here seal-plossys-5-log.
In Index patterns, specify the name of the index followed by -*, here seal-plossys-5-log-*.
Leave the Component templates tab unchanged:
In the Index settings tab, enter the JSON object as shown in the following screenshot.

The JSON object given here belongs to the seal-plossys-5-log index template. Repeat the steps for any other index you need, i. e. seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting or seal-easyprima-audit.
```
{
  "index": {
    "lifecycle": {
      "name": "seal-plossys-5-log",
      "rollover_alias": "seal-plossys-5-log"
    },
    "mapping": {
      "total_fields": {
        "limit": "2000"
      }
    }
  }
}
```

In the Mappings tab, specify the reqired items. These depend on the index template you currently configure.

For seal-plossys-5-log, click Load JSON and enter the following JSON object:

{
  "properties": {
    "metadata": {
      "properties": {
        "jobId": {
          "type": "keyword"
        },
        "jobProperties": {
          "type": "object"
        },
        "printer": {
          "type": "keyword"
        },
        "psProperties": {
          "type": "flattened",
          "ignore_above": 8191
        }
      }
    }
  }
}

Create Template 5

For seal-plossys-5-accounting, click Load JSON and enter the following JSON object:

{
  "properties": {
    "accounting": {
      "properties": {
        "metadata": {
          "properties": {
            "jobID": {
              "type": "keyword"
            }
          }
        },
        "principal": {
          "properties": {
            "deviceID": {
              "type": "keyword"
            },
            "printer": {
              "type": "keyword"
            },
            "userID": {
              "type": "keyword"
            }
          }
        },
        "resources": {
          "properties": {
            "inputPages": {
              "type": "nested"
            }
          }
        }
      }
    }
  }
}

Create Template 7

seal-plossys-5-statistics and seal-plossys-5-audit do not require any JSON objects:

Leave the Aliases tab unchanged:
In the Review template tab, click Create template:

Create the writing aliases for the seal-plossys-5-log index.

Repeat the steps for any other index you need, i. e. seal-plossys-5-statistics, seal-plossys-5-audit, seal-plossys-5-accounting or seal-easyprima-audit:
- In the Console tab, enter the code for the seal-plossys-5-log index in the left column, as given below.
  
  Adjust the code for any other index templates accordingly.
```
PUT seal-plossys-5-log-000001
{
  "aliases": {
    "seal-plossys-5-log": {
      "is_write_index": true
    }
  }
}
```
- Click the arrow button.
Check the list of the indices. The Index Management list now contains the indices you have configured so far:

Start the seal-filebeat services on all PLOSSYS 5, PLOSSYS 4 and easyPRIMA servers:

sudo systemctl start seal-filebeat

sudo systemctl start seal-p4-accounting-filebeat

Creating an Index Pattern for the Audit Indices¶

For the seal-plossys-5-audit index, you have to create an index pattern. Repeat the steps for seal-easyprima-audit, if necessary:

In the Kibana section, change to Index Patterns and click Create index pattern.
While typing seal-plossys-5-audit in Index pattern name, the list below shrinks to the fitting indices:
Proceed with Next step:
Select @timestamp from the list of available fields for refreshing the data and click Create index pattern:

Optionally, click Show advanced settings, enter seal-plossys-5-audit as Custom index pattern ID and click Create index pattern:
In the overview, you can select the seal-plossys-5-audit index pattern now:
The audit data is listed and you can configure the view:

Creating a Common Index Pattern for Audit Indices¶

The audit data of PLOSSYS 5 are stored in the seal-plossys-5-audit index. The audit data of easyPRIMA are stored in the seal-easyprima-audit index.

You can create a common index pattern, e. g. seal-*-audit, to access the audit data of both products:

In the Kibana section, change to Index Patterns and click Create index pattern.
In Index pattern name, enter seal-*-audit and click Next step:
In the list of available fields to refresh the data, select @timestamp and click Create index pattern:

Optionally, click Show advanced settings, enter seal-*-audit as Custom index pattern ID and click Create index pattern:
Select the seal-*-audit index pattern and configure the view: