Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 14 hours
Course Outline
Open-Source Search and Analytics Independence
- Evolutions in Elastic licensing and the emergence of forks.
- Comparative feature alignment between OpenSearch and Elasticsearch in 2025-2026.
- Key applications: enterprise search, log analytics, SIEM, and observability.
Cluster Architecture
- Node roles: master, data, coordinating, and ingest.
- Security plugin configuration: TLS internode communication, certificates, and PKI.
- Mitigating split-brain scenarios via discovery.seed_hosts and minimum master node settings.
Data Ingestion
- Indexing via REST API, bulk operations, and mapping definition.
- Integration of Beats, Fluent Bit, and Logstash pipelines.
- Utilizing the OpenTelemetry Collector for trace and metric collection.
Search and Dashboards
- Query DSL components: match, term, range, aggregations, and nested fields.
- Creating visualizations and dashboards in OpenSearch Dashboards.
- SIEM scenarios: defining alert rules and detecting anomalies.
Index Management
- Index Lifecycle Management (ILM): rollover, shrinking, and deletion strategies.
- Implementing hot-warm-cold storage architectures.
- Optimizing mappings and text analysis techniques.
Security and Access Control
- Implementing RBAC through users, roles, and tenants.
- Authentication via SAML and OpenID Connect.
- Enforcing document-level security and field-level masking.
Backup and Recovery
- Configuring snapshot repositories on MinIO, S3, or NFS.
- Automating snapshots using Curator or ISM.
- Recovering specific indices and executing cluster-wide disaster recovery.
Requirements
- Familiarity with search engine mechanics and inverted indexing concepts.
- Proficiency in working with REST APIs and JSON structures.
- Basic Linux administration skills, including systemd, log management, and package handling.
Target Audience
- Engineers specializing in search and log analytics.
- Teams transitioning away from managed Elasticsearch or Splunk instances.
- Security analysts developing sovereign SIEM infrastructure.
Testimonials (1)
the trainer was very good and made the training perfect for my needs
