Updating SEAL Elastic Stack with New Installation¶

If you wish to update your SEAL Elastic Stack installation to version 8.x and benefit from the automatic security configuration provided with version 8.x, you can update your SEAL Elastic Stack installation manually by

creating a backup of your 7.17.5 data
installing the 8.x version of SEAL Elastic Stack with the activated security settings and
restoring your data.

Stopping Incoming Data¶

Stop any Filebeat that sends data to your management server:

On any affected system, execute the corresponding command:

PLOSSYS Output Engine
```
stop-service seal-filebeat
```

PLOSSYS 4

stop-service seal-p4-accounting-filebeat

SEAL Operator
```
stop-service seal-operator-filebeat
```
DPF
```
stop-service seal-dpf-filebeat
```

Creating a Backup of all Relevant Data¶

Repository Path¶

In the elasticsearch.yml configuration file, you have to define the allowed locations for repositories in advance:

path.repo: "your_path"

Example - allowed locations

Elasticsearch is allowed to store repositories in the /mountbackups and /mount/long_term_backups directories. You can specify the 2 directories

in separate lines:

path.repo:
    - /mount/backups
    - /mount/long_term_backups

in one single line:

path.repo: ["/mount/backups","/mount/long_term_backups"]

Caution - existing directories with writing access

These directories must already be existing and Elasticsearch must be granted writing access.

Restart Elasticsearch:

sudo systemctl restart seal-elasticsearch

Registering a Snapshot Repository¶

You can register snapshot repositories

interactively via the Kibana user interface:

http://localhost:5601/app/management/data/snapshot_restore/sitories

with the appropriate command via the DevTools Console in the na user interface:
```
http://localhost:5601/app/dev_tools#/console
```

Example - registering a repository

You have to register the <my_repository> repository under the unt/backups/` path:

PUT _snapshot/<my_repository>
{
    "type": "fs",
    "settings": {
    "location": "/mount/backups/<my_repository_location>"
    }
}

Use the <my_repository> name of the snapshot repository in snapshot policies.

Caution - database failure

In case of a complete failure of the database contents, also information about the registered repositories is lost. have to reregister the snapshot directory with the above and first, before you can restore backups.

Verifying a Repository¶

We recommend verifying the connection to a newly registered snapshot repository. You can co this

in the Kibana user interface by clicking the Verify repository button:

http://localhost:5601/app/management/data/snapshot_restore/repositories/<my_repository>

in the DevTools Console with the following command:
```
POST /_snapshot/<my_repository>/_verify
```

Creating a Backup¶

Select all indices and feature states of the data you whish to back up:
- log data
- customer-specific configuration, using feature states
  Hint - backup command features
  
  You get a full list of available features with this backup command:
```
GET /_features
```
- security settings, i.e. users and roles
- kibana, i.e. dashboards and index patterns
- enrich policies

Add your indices and feature states to the following command:

PUT /_snapshot/<my_repository>/update_7_to_8
{
  "indices": ["seal-dpf-accounting", "seal-dpf-log"],
  "ignore_unavailable": true,
  "include_global_state": false,
  "feature_states": ["kibana"]
}

Execute the command.

You can check the progress of the backup under Stack Management.

Caution - wait for finished command

Wait until the execution of the backup command has finished before you move on to the next step.

Installing SEAL Elastic Stack¶

If you use a new server, skip this step.

If you stay on the current server, uninstall SEAL Elastic Stack and delete any leftover data under the following paths:
- /opt/seal/etc/data/seal-elasticsearch
- /opt/seal/etc/data/seal-kibana
- /opt/seal/etc/config/seal-elasticsearch
- /opt/seal/etc/config/kibana.yml
Install the desired seal-elasticstack version using the install.ps1 script.

Caution - NO configuration yet

Do not yet run the configuration script.

Restoring Your Data¶

In the elasticsearch.yml configuration file add the path to desired backup repository location:

path.repo: "your_path"

restart seal-elasticsearch

sudo systemctl restart seal-elasticsearch

Register the repository:

In the dev-tools console (http://localhost:5601/app/dev_tools#/ole) execute this command:

PUT _snapshot/<my_repository>
{
    "type": "fs",
    "settings": {
    "location": "<my_repository_location>"
    }
}

Add your indices and feature states to the following command:

POST /_snapshot/<my_repository>/update_7_to_8/_restore
{
  "feature_states": [ "kibana" ]
}

Execute the command.

Caution - wait for finished command

Wait until the execution of the backup command has finished before you move on to the next step.
Execute the configuration script:

Configuring SEAL Elastic Stack via Script

Allowing for Incoming Data¶

Start any Filebeat that sends data to your management server:

On any affected system, execute the corresponding command:

PLOSSYS Output Engine
```
sudo systemctl start seal-filebeat
```

PLOSSYS 4

sudo systemctl start seal-p4-accounting-filebeat

SEAL Operator

sudo systemctl start seal-operator-filebeat

DPF
```
sudo systemctl start seal-dpf-filebeat
```