Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- General overview of the Elastic Stack (ELK)
ELK Stack Architecture and Current Environment Assessment
- Review of Altor CB's existing architecture
- Core ELK components: Elasticsearch, Logstash, Kibana, and Beats
- Ingest nodes versus Logstash functionality
- Scalability and performance considerations for on-premise deployments
- Administrative best practices
Beats – Distributed Monitoring Solutions
- Configuration and deployment of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Securing data transmission with SSL
- Comparison of preconfigured modules versus custom inputs
- Integration with Logstash and Ingest Pipelines
Parsing and Ingesting Logs from Applications and Databases
- Ingestion of custom application logs
- Leveraging Logstash for data parsing and transformation
- Application of filters: grok, dissect, kv, mutate, and date
- Establishing database connections (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
- Practical scenarios: error logs, audit trails, traces, and slow queries
Advanced Search Techniques and Regular Expressions
- Advanced search syntax within Kibana
- Implementation of regular expressions (regex)
- Utilization of filters and logical OR/AND combinations
- Handling nested fields and arrays
- Creating and saving reusable queries and filters
Custom Dashboards and Visualizations in Kibana
- Visualization options: bar charts, line graphs, maps, and tables
- Applying aggregations and metrics
- Dynamic filters, controls, and drill-down capabilities
- Sharing dashboards across teams
- Practical exercises: constructing dashboards from database and system logs
Alerting Mechanisms and Email Notifications
- Overview of Watcher and alternative solutions (ElastAlert, Kibana Alerts)
- Defining custom conditions and triggers
- Configuring email output channels
- Exercise: Triggering alerts upon detection of critical events in Windows or database logs
User and Permission Administration
- Introduction to X-Pack and free-tier options
- Creation of users and role definitions
- Access control based on indexes, dashboards, and specific queries
- Exercise: Defining roles for audit and operations teams
Elasticsearch REST API Integration
- Fundamentals of the Elasticsearch RESTful API
- Executing GET and POST queries
- Manual and automated indexing processes
- Utilization of tools such as curl and Postman
- Practical exercises: Searching, inserting, deleting, and updating documents
Requirements
- A foundational understanding of the basic ELK Stack architecture and its components.
- Practical experience in ingesting and visualizing logs using Kibana and Logstash.
- Proficiency with the Linux command line and basic scripting concepts.
Target Audience
- System administrators
- Infrastructure engineers
- Technical teams aiming to advanced log centralization capabilities
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
