Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- General overview of the Elastic Stack (ELK).
ELK Stack Architecture and Review of Existing Environment
- Examination of Altor CB's current architecture.
- Core ELK components: Elasticsearch, Logstash, Kibana, and Beats.
- Differences between Ingest nodes and Logstash.
- Scalability and performance factors in on-premise setups.
- Best practices for administration.
Beats – Distributed Monitoring
- Configuration and application of Filebeat, Auditbeat, Winlogbeat, and Packetbeat.
- Secure data transmission via SSL.
- Comparison of preconfigured modules versus custom inputs.
- Integration with Logstash and Ingest Pipelines.
Parsing and Ingesting Logs from Applications and Databases
- Ingestion of custom application logs.
- Leveraging Logstash for data parsing and transformation.
- Application of filters: grok, dissect, kv, mutate, and date.
- Database connections (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin.
- Practical scenarios: error logs, audit trails, traces, and slow queries.
Advanced Search and Regular Expressions
- Advanced search syntax in Kibana.
- Application of regular expressions (regex).
- Using filters and OR/AND logical combinations.
- Handling nested fields and arrays.
- Creating and saving reusable queries and filters.
Custom Dashboards and Visualizations in Kibana
- Types of visualizations: bar charts, line graphs, maps, and tables.
- Utilizing aggregations and metrics.
- Implementing dynamic filters, controls, and drill-down capabilities.
- Dashboard sharing protocols.
- Exercise: Constructing dashboards from database and system logs.
Alerts and Email Notifications
- Overview of Watcher and alternatives (ElastAlert, Kibana Alerts).
- Defining custom conditions and triggers.
- Configuring email outputs.
- Exercise: Triggering an alert upon detection of critical events in Windows or database logs.
User and Permission Management
- Introduction to X-Pack and available free options.
- Creation of users and roles.
- Access control based on index, dashboard, and query level.
- Exercise: Defining roles for audit and operations teams.
Elasticsearch REST API
- Basics of the Elasticsearch RESTful API.
- Execution of GET and POST queries.
- Manual and automated indexing processes.
- Utilization of tools such as curl and Postman.
- Exercises: Searching, inserting, deleting, and updating documents.
Requirements
- A solid understanding of the fundamental ELK Stack architecture and its components.
- Practical experience with log ingestion and visualization using Kibana and Logstash.
- Familiarity with Linux command-line operations and basic scripting.
Target Audience
- System administrators.
- Infrastructure engineers.
- Technical teams looking to advance their log centralization capabilities.
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
