Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- Broad overview of the Elastic Stack (ELK)
ELK Stack Architecture and Environmental Review
- Assessment of the existing Altor CB architecture
- ELK components: Elasticsearch, Logstash, Kibana, and Beats
- Comparing Ingest nodes with Logstash
- Scalability and performance factors for on-premise deployments
- Best practices for administration
Beats – Distributed Monitoring
- Setup and utilization of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Securing data transmission via SSL
- Contrasting preconfigured modules with custom inputs
- Integrating with Logstash and Ingest Pipelines
Log Parsing and Ingestion from Applications and Databases
- Incorporating custom application logs
- Utilizing Logstash for data parsing and transformation
- Applying filters: grok, dissect, kv, mutate, date
- Establishing database connections (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
- Practical scenarios: error logs, audit trails, traces, and slow queries
Advanced Search and Regular Expressions
- Advanced query syntax in Kibana
- Application of regular expressions (regex)
- Employing filters and OR/AND logic combinations
- Handling nested fields and arrays
- Storing reusable queries and filter sets
Custom Dashboards and Visualizations in Kibana
- Visualization formats: bar charts, line graphs, maps, tables
- Working with aggregations and metrics
- Implementing dynamic filters, controls, and drill-down capabilities
- Dashboard sharing protocols
- Practical tasks: building dashboards from database and system logs
Alerts and Email Notifications
- Overview of Watcher and alternatives (ElastAlert, Kibana Alerts)
- Defining custom conditions and triggers
- Configuring email outputs
- Practical task: triggering alerts upon detection of critical events in Windows or database logs
User and Permission Administration
- Introduction to X-Pack and complimentary features
- Creating users and assigning roles
- Controlling access by index, dashboard, and query
- Practical task: establishing roles for audit and operations teams
Elasticsearch REST API
- Core concepts of the Elasticsearch RESTful API
- Executing GET / POST queries
- Manual versus automated indexing processes
- Leveraging tools such as curl and Postman
- Practical tasks: searching, inserting, deleting, and updating documents
Requirements
- A solid grasp of fundamental ELK Stack architecture and its core components
- Practical experience in log ingestion and visualization using Kibana and Logstash
- Proficiency with Linux command-line interfaces and basic scripting techniques
Target Audience
- System administrators
- Infrastructure engineers
- Technical teams aiming to elevate their log centralization capabilities
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
