Skip to content

Configure Elastic Stack

For an overview of Elastic Stack and its components used with PLOSSYS 5, refer to Elastic Stack.

In Elasticsearch, different indices are used for log messages, for statistics messages and for audit messages of PLOSSYS 5.

Configure the Housekeeping of the Messages (Index Lifecycle Management, ILM)

For the messages, you can configure the housekeeping in Elasticsearch via the Kibana user interface (Index Lifecycle Management). Previously, Elasticsearch Curator has been used for the housekeeping of the messages in Elasticsearch. This is no longer required.

  1. Stop the seal-filebeat services on all PLOSSYS 5 servers (if already installed) so that no new messages will be sent to Elasticsearch:

    plossys service stop seal-filebeat

  2. Open the Kibana user interface:

    http://<admin_server>:5601

  3. Delete the old indices due to these were created by seal-filebeat by default:

    Delete Indices

  4. Create index lifecycle policies for the desired indices (seal-plossys-5-log, seal-plossys-5-statistics, seal-plossys-5-audit) and specify the following settings:

    Create Policy 1

    • In the Name section, specify Policy name. Although the policy name is arbitrary, we recommend using the same name as for the index (seal-plossys-5-log).

    • In the Hot phase section, specify Maximum index size. We recommend 10 GB.

    Create Policy 2

    • Switch on Activate delete phase, and then specify Timing for delete phase in the activated section. We recommend 7 days.

    Create Policy 3

    Repeat the steps for seal-plossys-5-statistics and seal-plossys-5-audit correspondingly if desired.

  5. Create index templates for the indices and specify the following settings:

    Create Template 1

    • In the Logistics tab, specify Name. We recommend using the same name as for the index (seal-plossys-5-log).

    • In Index patterns, specify the name of the index followed by -* (seal-plossys-5-log-*).

    Create Template 2

    • In the Index settings tab, enter the following JSON object:

      {
  "index": {
    "lifecycle": {
      "name": "seal-plossys-5-log",
      "rollover_alias": "seal-plossys-5-log"
    }
  }
}

    Create Template 3

    • In the Mappings tab, nothing has to be specified:

    Create Template 4

    • In the Aliases tab, nothing has to be specified:

    Create Template 5

    • Click Create template.

    Create Template 6

    Repeat the steps for seal-plossys-5-statistics and seal-plossys-5-audit correspondingly if desired.

  6. Create write aliases for the indices:

    • In the Console tab, enter the following code in the left column and click the arrow button afterwards:

      PUT seal-plossys-5-log-000001
{
  "aliases": {
    "seal-plossys-5-log": {
      "is_write_index": true
    }
  }
}

    Create Write Alias

    Repeat the step for seal-plossys-5-statistics and seal-plossys-5-audit correspondingly if desired.

  7. Check the list of the indices. The Index Management list now contains the indices for seal-plossys-5-log, seal-plossys-5-statistics and seal-plossys-5-audit if configured:

    Index Management

  8. Start the seal-filebeat services on all PLOSSYS 5 servers (if already installed):

    plossys service start seal-filebeat

Activate the Pattern for the seal-plossys-5-audit Index

With PLOSSYS 5.3.3., audit messages have been introduced. When updating to PLOSSYS 5.3.3, you have to adjust filebeat.yml manually as described in Update on Windows or Update on Linux and restart the PLOSSYS system.

With audit messages, the following indices are listed in Elasticsearch:

Indices in Elasticsearch With Audit

For the audit messages, you have to create an index pattern:

  1. Change to Index Patterns in the Kibana section and click Create index pattern.

    Create Index Pattern

  2. Select seal-plossys-5-audit from the list of existent indices in the creation dialog:

    Select the Audit Index

  3. Proceed to the next step:

    Next Step

  4. Select @timestamp from the list of available fields for refreshing the data and click Create index pattern:

    Set Field for Refresh

  5. In the overview, you can select the seal-plossys-5-audit index pattern now:

    Select Audit Index Pattern

  6. The audit messages are listed and you can configure the view:

    List Audit Messages

Indices Used in Elasticsearch for PLOSSYS 5

The indices used in Elasticsearch for the log and statistics messages of PLOSSYS 5 are specified in the following keys in the PLOSSYS 5 system:

Back to top