Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- Broad overview of the Elastic Stack (ELK)
ELK Stack Architecture and Current Environment Review
- Assessment of Altor CB’s existing architecture
- Components of the ELK stack: Elasticsearch, Logstash, Kibana, and Beats
- Comparison between Ingest nodes and Logstash
- Scalability and performance factors in on-premise deployments
- Best practices for administration
Beats – Distributed Monitoring
- Setup and application of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Securing data transmission with SSL
- Differentiation between preconfigured modules and custom inputs
- Integration with Logstash and Ingest Pipelines
Log Parsing and Ingestion from Applications and Databases
- Capturing custom logs from various applications
- Employing Logstash for data parsing and transformation
- Application of filters: grok, dissect, kv, mutate, and date
- Establishing database connections (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
- Real-world scenarios: error logs, audit trails, traces, and slow queries
Advanced Search and Regular Expressions
- Complex search syntax within Kibana
- Application of regular expressions (regex)
- Utilization of filters with OR/AND logical combinations
- Handling nested fields and arrays
- Preserving reusable queries and filters
Custom Dashboards and Visualizations in Kibana
- Types of visualizations: bar charts, line graphs, maps, and tables
- Implementing aggregations and metrics
- Using dynamic filters, controls, and drill-down capabilities
- Sharing dashboards
- Practical tasks: building dashboards from database and system logs
Alerts and Email Notifications
- Overview of Watcher and alternative solutions (ElastAlert, Kibana Alerts)
- Defining custom conditions and triggers
- Configuring email outputs
- Practical task: triggering alerts upon detection of critical events in Windows or database logs
User and Permission Management
- Introduction to X-Pack and available free options
- Creation of users and roles
- Implementing access controls for indices, dashboards, and queries
- Practical task: defining roles for audit and operations teams
Elasticsearch REST API
- Fundamentals of the Elasticsearch RESTful API
- Executing GET and POST queries
- Managing manual and automated indexing
- Using tools such as curl and Postman
- Practical tasks: performing search, insertion, deletion, and update operations on documents
Requirements
- A solid grasp of fundamental ELK Stack architecture and components
- Practical experience in ingesting and visualizing logs via Kibana and Logstash
- Proficiency with the Linux command line and basic scripting
Target Audience
- System administrators
- Infrastructure engineers
- Technical teams aiming to implement advanced log centralization strategies
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
