Configuring SEAL Elastic Stack via Script¶

Elasticsearch uses different indices for the log, statistics, audit and accounting data of PLOSSYS 5.

For easyPRIMA you only need to configure audit data in Kibana.

For the different indices you can configure the housekeeping in Elasticsearch (Index Lifecycle Management, ILM).

If you prefer to proceed manually in the Kibana user interface, you will find the step-by-step instructions in Configuring SEAL Elastic Stack by Hand .

Hint - common index patterns for audit indices

The load-config script does not include the configuration of a common index pattern for audit indices of PLOSSYS 5 and easyPRIMA.

For details on this, refer to Creating a Common Index Pattern for Audit Indices below.

The `load-config` Script¶

SEAL Elastic Stack provides the load-config script and several configuration files to create all necessary components for the housekeeping of the stored data of PLOSSYS 5, PLOSSYS 4 and easyPRIMA.

You will find the script in the following directory:

C:\Program Files\SEAL Systems\seal-kibana\configuration\load-config.ps1

You may use the load-config script in different operation modes:

Non-overwrite mode:

The load-config script checks, whether the specific index exists and adds only settings that are missing.
Overwrite mode:

The load-config script overwrites some settings.

Hint - dashboards

Independent of the operation mode, the load-config script always overwrites the dashboard configurations to protect the consistency of the consecutive configurations.

Hint - index Lifecycle Policies

Independent of the operation mode, the load-config script never overwrites the index lifecycle policies.

Hint - usage

Execute the configuration script with the -h or -help option to get the usage.

Executing the Script¶

Stop the seal-filebeat services on all PLOSSYS 5, PLOSSYS 4 and easyPRIMA servers to stop the data transfer to Elasticsearch:
```
stop-service seal-filebeat
```
```
stop-service seal-p4-accounting-filebeat
```
By default, the configuration matches the installation of PLOSSYS 5, PLOSSYS 4 and easyPRIMA. If you still need to modify the configuration, do this on the management server in the directory structure described in Configuring the Script below.
In a PowerShell (Administrator) on the management server, start the load-config script for PLOSSYS 5:
```
C:\Program Files\SEAL Systems\seal-kibana\configuration\load-config.ps1
```

Start the load-config script a second time for easyPRIMA, if required:

C:\Program Files\SEAL Systems\seal-kibana\configuration\load-config.ps1 -c seal-easyprima

Start the load-config script a third time for PLOSSYS 4, if required:

/opt/seal/seal-kibana/configuration/load-config.sh -c seal-p4-accounting

Start the seal-filebeat services on all PLOSSYS 5 and management servers:
```
start-service seal-filebeat
```
Start the seal-p4-accounting-filebeat services on the PLOSSYS 4 server, if required:
```
start-service seal-p4-accounting-filebeat
```

Configuring the Script¶

The load-config script scans the directories stated below for JSON files and uses their content for the configuration of the different components of SEAL Elastic Stack.

If a JSON file or a subdirectory does not exist, the load-config script skips the configuration of the corresponding component:

C:\Program Files\SEAL Systems\seal-kibana\configuration\<product_name>

Example - configuration directory contained in SEAL Elastic Stack 7.16.0.53

Configuration Directory of Kibana

The subdirectories in the product-specific directories contain the JSON files for the different components:

index:

Elasticsearch index, for details on the syntax, see original documentation.
index-lifecycle-policy:

Housekeeping of the data in the specific index, for details on the syntax, see original documentation.
index-pattern:

Index patterns for accessing the data stored in the specific index, for details on the syntax, see original documentation.
index-template:

Template used when creating the index, for details on the syntax, see original documentation.
index-template/components:

Reusable subcomponents for index templates, for details on the syntax, see original documentation.

The JSON files in the component-specific directories are named according to the data type that is to be configured:

accounting.json
audit.json
log.json
statistics.json

The following subdirectory in the product-specific directories contains JSON files used to manipulate fields in index patterns:

fields:

Customization of fields of an index pattern, for details on the syntax, see original documentation.

The following subdirectory in the product-specific directories contains JSON files that are used to define ingest pipelines:

pipelines:

Ingest pipelines to adjust incoming data, for details on the syntax, see original documentation.

In Elasticsearch, you will find a lot of predefined processors for ingest pipelines, which are comparable to filebeat processors. For details on this, see original documentation.

The following subdirectory in the product-specific directories contains JSON files used to adjust sample dashboards of Kibana:

dashboard:

Dashboards to visualize the log data of PLOSSYS 5, for details on the syntax, see original documentation.

The following subdirectory in the product-specific directories contains JSON files used to customize sample Kibana searches:

search: Predefined searches for an easier analyzation of the log data, for details on the syntax, see original documentation.

Backup Files¶

Before changing existing settings, the load-config script saves the corresponding original files in the following directory:

$HOME/tmp/backup

Log File of the Script¶

The load-config script logs its own error messages in a log file in the following directory:

$env:TEMP/log

Indices for PLOSSYS 5¶

In some cases you need to adjust PLOSSYS 5 environment variables, e. g. if you use a Kibana workspace.

In the PLOSSYS 5 system, the indices used in Elasticsearch for the log and statistics data of PLOSSYS 5 are specified in the following keys:

ELASTICSEARCH_INDEX_LOG
ELASTICSEARCH_INDEX_STATISTICS

For details on the environment variables, refer to PLOSSYS 5.