anchor.diff:  ----
   ====
   +
  -Then, ensure the *logging-deployer* can edit the service. The following example
  -uses the `logging` project. Be sure to use the project created above in the
  -following example:
  +Then, enable the *logging-deployer* service account to edit the project
  +contents. By default service accounts are not allowed to do this.
  +The following example uses the `logging` project. Be sure to use the
  +project created above in the following example:
   +
   ====
   ----
   $ oc policy add-role-to-user edit \
  -          system:serviceaccount:logging:logging-deployer
  +            system:serviceaccount:logging:logging-deployer
  +----
  +====
  +
  +. Enable the Fluentd service account, which the deployer will create, that
  +requires special privileges to operate Fluentd. Edit the security context:
  ++
  +====
  +----
  +$ oc edit scc/privileged
  +----
  +====
  ++
  +And add the following user to the file. The following example uses the `logging`
  +project. Be sure to use the project created above in the following example:
  ++
  +====
  +----
  +- system:serviceaccount:logging:aggregated-logging-fluentd
  +----
  +====
  ++
  +Give the Fluentd service account permission to read labels from all pods. The
  +following example uses the `logging` project. Be sure to use the project created
  +above in the following example:
  ++
  +====
  +----
  +$ oadm policy add-cluster-role-to-user cluster-reader \
  +              system:serviceaccount:logging:aggregated-logging-fluentd
   ----
   ====
   
   == Deploying the EFK Stack
   
   The EFK stack is deployed link:../dev_guide/templates.html[using a template].
  -Doing so ensures all future project configurations will feature the EFK stack.
  -The default repository and branch of the template are set to origin/master.
  -Change these settings to suit your own instance if desired.
  -
  +Ansible-based installs should create the *_logging-deployer-template_* template in the *_openshift_* namespace.
   ifdef::openshift-enterprise[]
  -The template is available on install, and can be created with the following
  -command:
  -
  -----
  -$ oc create -f /usr/share/ansible/openshift-ansible/roles/openshift_examples/files/examples/infrastructure-templates/enterprise/logging-deployer.yaml
  +Otherwise, the template can be created with the following command:
  +
  +----
  +$ oc create -n openshift -f /usr/share/ansible/openshift-ansible/roles/openshift_examples/files/examples/infrastructure-templates/enterprise/logging-deployer.yaml
   ----
   endif::openshift-enterprise[]
  -
   ifdef::openshift-origin[]
  -The template can be created with the following command:
  -
  -----
  -$ oc create -f https://github.com/openshift/openshift-ansible/blob/master/roles/openshift_examples/files/examples/infrastructure-templates/origin/logging-deployer.yaml
  +Otherwise, the template can be created with the following command:
  +
  +----
  +$ oc create -n openshift -f https://github.com/openshift/openshift-ansible/blob/master/roles/openshift_examples/files/examples/infrastructure-templates/origin/logging-deployer.yaml
   ----
   endif::openshift-origin[]
   
  -
  -
  -[IMPORTANT]
  -====
  -The OpenShift Authentication Proxy (*openshift-auth-proxy*) depends on a *node*
  -base image, which is intended to be the DockerHub Node.js base image. Defining
  -standard templates also depends on a Node.js image called *node*, which will be
  -used instead of the intended image, causing the build to fail. To resolve this,
  -delete the older *node* image:
  -
  -----
  -$ oc delete is/node -n openshift
  -----
  -====
  -
  -After defining any builds, they should restart. If they do not, you can manually
  -restart each component:
  -
  -----
  -$ oc start-build <component>
  -----
  -
  -Once the builds have successfully completed, the image streams will be populated
  -and ready for deployment. However, you must first specify the `*IDEX_PREFIX*`
  -parameter with the registry location.
  -
  -. Run the deployer, specifying the host on which kibana will run, the amount of
  -instances of Elasticsearch to deploy, and the master URL where browsers will be
  -directed to when authenticating to OpenShift. Be sure to replace the
  -`*KIBANA_HOSTNAME*` and `*PUBLIC_MASTER_URL*` to values relevant to your
  -deployment:
  +. Run the deployer, specifying at least the parameters in the following example (more are described in the table below):
   +
   ====
   ----
  
positive.code: ----
  ====
  
  You can see the UI by visiting the site specified at the '*KIBANA_HOSTNAME*'
  variable.
  
  See the https://www.elastic.co/guide/en/kibana/4.1/discover.html[Kibana
  
negative.code: apiVersion: v1
  kind: DeploymentConfig
  spec:
    template:
      spec:
        nodeSelector:
          nodelabel: logging-es-node-1
  ----
  ====
  
  