Get in Touch
 Duration 21 hours

Course Outline

Introduction

  • Broad overview of the Elastic Stack (ELK)

ELK Stack Architecture and Current Environment Review

  • Assessment of the existing architecture of Altor CB
  • ELK components: Elasticsearch, Logstash, Kibana, and Beats
  • Comparison of Ingest nodes versus Logstash
  • Scalability and performance factors in on-premise setups
  • Best practices for administration

Beats for Distributed Monitoring

  • Setup and utilization of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
  • Secure data transmission using SSL
  • Preconfigured modules compared to custom inputs
  • Integration with Logstash and Ingest Pipelines

Log Parsing and Ingestion from Applications and Databases

  • Ingestion of custom application logs
  • Leveraging Logstash for data parsing and transformation
  • Application of filters: grok, dissect, kv, mutate, and date
  • Database connectivity (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
  • Real-world scenarios: error logs, audit trails, traces, and slow queries

Advanced Search Techniques and Regular Expressions

  • Advanced Kibana search syntax
  • Application of regular expressions (regex)
  • Combining filters using OR/AND logic
  • Handling nested fields and arrays
  • Saving queries and filters for reuse

Custom Dashboards and Visualizations in Kibana

  • Visualization formats: bar charts, line graphs, maps, and tables
  • Aggregations and metric calculations
  • Dynamic filters, controls, and drill-down functionalities
  • Dashboard sharing mechanisms
  • Practical exercises: building dashboards from database and system logs

Alerts and Email Notifications

  • Overview of Watcher and alternative solutions (ElastAlert, Kibana Alerts)
  • Defining custom conditions and triggers
  • Configuring email outputs
  • Practical exercise: triggering alerts for critical events in Windows or database logs

User and Permission Administration

  • Introduction to X-Pack and available free options
  • Creating users and assigning roles
  • Access control based on index, dashboard, and query
  • Practical exercise: defining roles for audit and operations teams

Elasticsearch REST API

  • Fundamentals of the Elasticsearch RESTful API
  • Executing GET and POST queries
  • Manual and automated indexing processes
  • Utilizing tools such as curl and Postman
  • Practical exercises: searching, inserting, deleting, and updating documents

Requirements

  • A solid grasp of the fundamental ELK Stack architecture and its components.
  • Hands-on experience with ingesting and visualizing logs using Kibana and Logstash.
  • Proficiency with the Linux command line and basic scripting.

Audience

  • System administrators
  • Infrastructure engineers
  • Technical teams aiming to enhance advanced log centralization capabilities

Number of participants


Price per participant

Testimonials (2)

Upcoming Courses

Related Categories