Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- Broad overview of the Elastic Stack (ELK)
ELK Stack Architecture and Current Environment Review
- Assessment of the existing architecture of Altor CB
- ELK components: Elasticsearch, Logstash, Kibana, and Beats
- Comparison of Ingest nodes versus Logstash
- Scalability and performance factors in on-premise setups
- Best practices for administration
Beats for Distributed Monitoring
- Setup and utilization of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Secure data transmission using SSL
- Preconfigured modules compared to custom inputs
- Integration with Logstash and Ingest Pipelines
Log Parsing and Ingestion from Applications and Databases
- Ingestion of custom application logs
- Leveraging Logstash for data parsing and transformation
- Application of filters: grok, dissect, kv, mutate, and date
- Database connectivity (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
- Real-world scenarios: error logs, audit trails, traces, and slow queries
Advanced Search Techniques and Regular Expressions
- Advanced Kibana search syntax
- Application of regular expressions (regex)
- Combining filters using OR/AND logic
- Handling nested fields and arrays
- Saving queries and filters for reuse
Custom Dashboards and Visualizations in Kibana
- Visualization formats: bar charts, line graphs, maps, and tables
- Aggregations and metric calculations
- Dynamic filters, controls, and drill-down functionalities
- Dashboard sharing mechanisms
- Practical exercises: building dashboards from database and system logs
Alerts and Email Notifications
- Overview of Watcher and alternative solutions (ElastAlert, Kibana Alerts)
- Defining custom conditions and triggers
- Configuring email outputs
- Practical exercise: triggering alerts for critical events in Windows or database logs
User and Permission Administration
- Introduction to X-Pack and available free options
- Creating users and assigning roles
- Access control based on index, dashboard, and query
- Practical exercise: defining roles for audit and operations teams
Elasticsearch REST API
- Fundamentals of the Elasticsearch RESTful API
- Executing GET and POST queries
- Manual and automated indexing processes
- Utilizing tools such as curl and Postman
- Practical exercises: searching, inserting, deleting, and updating documents
Requirements
- A solid grasp of the fundamental ELK Stack architecture and its components.
- Hands-on experience with ingesting and visualizing logs using Kibana and Logstash.
- Proficiency with the Linux command line and basic scripting.
Audience
- System administrators
- Infrastructure engineers
- Technical teams aiming to enhance advanced log centralization capabilities
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations