Course Outline
Introduction
- Comprehensive overview of the Elastic Stack (ELK)
Module 1: ELK Stack Architecture and Review of Existing Environment
- Assessment of Altor CB's current architecture
- ELK architecture deep-dive: Elasticsearch, Logstash, Kibana, Beats
- Distinguishing between Ingest nodes and Logstash
- Scalability and performance optimization for on-premise deployments
- Administration best practices
Module 2: Beats – Distributed Monitoring (2 hours)
- Configuration and utilization of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Securing data transmission via SSL
- Evaluating preconfigured modules versus custom inputs
- Integration strategies with Logstash and Ingest Pipelines
Module 3: Parsing and Ingesting Logs from Applications and Databases (4 hours)
- Acquiring custom logs from applications
- Employing Logstash for data parsing and transformation
- Utilizing filters: grok, dissect, kv, mutate, date
- Establishing database connections (Oracle, PostgreSQL, SQL Server) via JDBC input plugin
- Practical scenarios: handling error logs, audit trails, traces, and slow queries
Module 4: Advanced Search and Regular Expressions (2 hours)
- Mastering advanced search syntax in Kibana
- Applying regular expressions (regex)
- Constructing filters with OR/AND logic
- Navigating nested fields and arrays
- Storing and reusing queries and filters
Module 5: Custom Dashboards and Visualizations in Kibana (3 hours)
- Exploring visualization types: bar charts, line graphs, maps, tables
- Understanding aggregations and metrics
- Implementing dynamic filters, controls, and drill-down functionalities
- Sharing dashboards across teams
- Practical exercises: building dashboards from database and system logs
Module 6: Alerts and Email Notifications (3 hours)
- Overview of Watcher and alternative tools (ElastAlert, Kibana Alerts)
- Designing custom conditions and triggers
- Configuring email output settings
- Exercise: triggering alerts for critical events detected in Windows or database logs
Module 7: User and Permission Management (2 hours)
- Introduction to X-Pack and its free-tier options
- Creating distinct users and roles
- Enforcing access control based on index, dashboard, and query parameters
- Exercise: defining roles for audit and operational teams
Module 8: Elasticsearch REST API (3 hours)
- Understanding the fundamentals of Elasticsearch RESTful API
- Executing GET and POST queries
- Performing manual and automated indexing operations
- Utilizing tools such as curl and Postman
- Exercises: searching, inserting, deleting, and updating documents
Summary and Next Steps
Requirements
- A foundational understanding of ELK Stack architecture and its core components
- Practical experience in ingesting and visualizing logs using Kibana and Logstash
- Competency with the Linux command line and basic scripting skills
Audience
- System administrators
- Infrastructure engineers
- Technical teams looking to implement advanced log centralization capabilities
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
