Configure SEAL Elastic Stack¶

PLOSSYS Distribution Engine manages and visualizes its log, statistics, and accounting data by means of Elastic Stack. Elastic Stack consists of Elasticsearch and Kibana. The installation is optional. For more information, refer to the SEAL Elastic Stack documentation.

As of version 2.2.0, PLOSSYS Distribution Engine contains the configurations for Filebeat and Elastic Stack. With these configurations, PLOSSYS Distribution Engine can send its log data to any Elastic Stack system. This can be a SEAL Elastic Stack or a customer-specific Elastic Stack. The seal-dpf-filebeat service forwards the service log files and the accounting data.

This page describes how to configure Elasticsearch and Kibana and Filebeat for PLOSSYS Distribution Engine.

Configure Elasticsearch and Kibana¶

The seal-dist-ngn-elasticstack-configuration package of the Process Printing bundle provides the load-config.js script and the Distribution Engine-specific configuration files. The script creates the following components:

Aliases in Elasticsearch for the log data of DPF, of the DPF services, and of PLOSSYS Output Engine.
The data view seal-distngn-log in Kibana. It covers all these aliases.

This section describes the configuration via script. For the manual configuration in the Kibana user interface, refer to Configuring SEAL Elastic Stack by Hand.

Hint - after an update

Run the load-config script again after each Distribution Engine update.

The `load-config` Script¶

You find the script in the following directory:

C:\Program Files\SEAL Systems\seal-dist-ngn-elasticstack-configuration\configuration\

The script supports the following options:

-h, -help: prints the help.
-c, -configname: name of the configuration subdirectory. Default: seal-distngn.
-l, -url: Elasticsearch URL. Default: http://localhost:9200.
-k, -kurl: Kibana URL. Default: http://localhost:5601.
-u, -user: user name and password for Elasticsearch, separated by a colon, for example admin:secret.
-o, -overwrite: overwrites existing workspaces and indices.
-w, -workspace: Kibana workspace the configuration is added to.
-cd, -customdir: one or more directories with customer-specific configuration files. Separate several directories with a semicolon.
-ca, -customargs: arguments for the customer-specific configuration files. Separate the argument sets of several directories with a semicolon. Keep the order of the -cd directories, for example -ca "-foo|bar;-foo|baz".
-n, -no-orig: installs only the customer-specific configuration files, not the original ones.

The script reads the JSON files in the seal-distngn subdirectory. If a JSON file or a subdirectory does not exist, the script skips the corresponding component. For the structure of the subdirectory, refer to Elastic Stack Configuration Files.

Hint - overwriting

By default, the script checks whether an index exists and adds only missing settings. With -o, the script overwrites existing workspaces and indices.

Independent of -o, the script always overwrites the following:

Dashboard configurations
Index templates
Pipelines that are not customer-specific

The script never overwrites the following:

Index lifecycle policies
Customer-specific pipelines. Their names contain the string custom. To update them, delete them in the Kibana user interface first.

For more information, refer to Configuring Pipelines.

Execute the Script¶

Stop the Filebeat service on all Distribution Engine servers to stop the data transfer to Elasticsearch:
```
Stop-Service seal-dpf-filebeat
```
If PLOSSYS Output Engine sends its log data to the same Elasticsearch, also stop seal-out-ngn-filebeat on the Output Engine servers.
By default, the configuration matches the PLOSSYS Distribution Engine installation. To change it, edit the files described in Elastic Stack Configuration Files.

Open a PowerShell as Administrator and change to the following directory:

cd "C:\Program Files\SEAL Systems\seal-dist-ngn-elasticstack-configuration"

Start the load-config script. Specify the URLs of Elasticsearch and Kibana and the Elasticsearch credentials:
```
.\node.exe .\configuration\load-config.js -l <elasticsearch_url> -k <kibana_url> -u <user>:<password>
```
Start the Filebeat services again:
```
Start-Service seal-dpf-filebeat
```

Backup Files¶

Before the script changes existing settings, it saves the original files in the following directory:

C:\Program Files\SEAL Systems\seal-dist-ngn-elasticstack-configuration\configuration\tmp\backup

Log Files of the Script¶

The script writes its error messages to log files in the following directory:

C:\Program Files\SEAL Systems\seal-dist-ngn-elasticstack-configuration\configuration\tmp\log

Load the DPF Dashboards¶

SEAL Elastic Stack provides Kibana dashboards for DPF in its own seal-elasticstack-configuration package. The load-config script of Distribution Engine does not load them. The Dpf_Support dashboard contains the following panels:

Job Statistics
Output Channel Statistics, with the number of output jobs per channel
PrintJob Type Statistics, with the number of output jobs per PRINTJOB_TYPE

To load the dashboards, execute the following steps on the server with SEAL Elastic Stack:

Open a PowerShell as Administrator and change to the following directory:
```
cd "C:\Program Files\SEAL Systems\seal-elasticstack-configuration"
```
Start the load-config script of SEAL Elastic Stack with the seal-dpf configuration. Specify the URLs of Elasticsearch and Kibana and the Elasticsearch credentials:
```
.\node\node.exe .\configuration\load-config.js -c seal-dpf -l <elasticsearch_url> -k <kibana_url> -u <user>:<password>
```

For more information, refer to Configuring SEAL Elastic Stack via Script.

Configure Filebeat¶

PLOSSYS Distribution Engine uses the seal-dpf-filebeat service. It sends the following data to Elasticsearch:

Job logs, to the index seal-dpf-log
Accounting data, to the index seal-dpf-accounting
Service logs, to the index seal-dpf-servicelog

Entries that cannot be processed go to the index seal-dpf-unmapped.

Open the Filebeat configuration file in an editor:

C:\ProgramData\SEAL Systems\config\filebeat-dpf.yml

In the output.elasticsearch section, adjust the following values:
- hosts: URL of Elasticsearch. Use the FQDN if Elasticsearch runs on another server or if you use HTTPS.
- username and password: credentials for Elasticsearch. Instead of password, you can store the password in the Filebeat keystore under the key ES_PWD and set password: "${ES_PWD}".
Restart the Filebeat service:
```
Restart-Service seal-dpf-filebeat
```

Hint - Elasticsearch credentials

When Elastic Stack is installed, minimal security is activated and a random password is created for the elastic user. To reset this password, refer to Resetting Passwords.

Filebeat Log Files¶

Filebeat writes its log files to the following directory:

C:\ProgramData\SEAL Systems\log

The base name is seal-dpf-filebeat.log. Filebeat adds the date and a rotation ID, for example seal-dpf-filebeat.log-20260526-3.ndjson. The name of the most recent log file therefore changes with each rotation. Filebeat keeps 7 log files.