Course Outline
Introduction
- General overview of the Elastic Stack (ELK)
Module 1: ELK Stack Architecture and Review of Existing Environment
- Review of the current architecture at Altor CB
- Overview of ELK architecture: Elasticsearch, Logstash, Kibana, Beats
- Differences between Ingest nodes and Logstash
- Scalability and performance considerations for on-premise installations
- Best practices for administration
Module 2: Beats – Distributed Monitoring (2 hours)
- Configuration and usage of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Secure data shipping using SSL
- Distinguishing between preconfigured modules and custom inputs
- Integration with Logstash and Ingest Pipelines
Module 3: Parsing and Ingesting Logs from Applications and Databases (4 hours)
- Ingesting custom logs generated by applications
- Leveraging Logstash for data parsing and transformation
- Utilizing filters such as grok, dissect, kv, mutate, and date
- Establishing database connections (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
- Practical scenarios: handling error logs, audit trails, traces, and slow queries
Module 4: Advanced Search and Regular Expressions (2 hours)
- Mastery of advanced search syntax in Kibana
- Effective use of regular expressions (regex)
- Applying filters and combining OR/AND logic
- Navigating nested fields and arrays
- Saving reusable queries and filters for efficiency
Module 5: Custom Dashboards and Visualizations in Kibana (3 hours)
- Exploring visualization types: bar charts, line graphs, maps, and tables
- Working with aggregations and metrics
- Implementing dynamic filters, controls, and drill-down features
- Dashboards sharing protocols
- Exercises: building dashboards from database and system logs
Module 6: Alerts and Email Notifications (3 hours)
- Introduction to Watcher and alternative solutions (ElastAlert, Kibana Alerts)
- Designing custom conditions and triggers
- Configuring email output settings
- Exercise: sending alerts upon detection of critical events in Windows or database logs
Module 7: User and Permission Management (2 hours)
- Overview of X-Pack and available free alternatives
- Creating users and defining roles
- Managing access control at the index, dashboard, and query levels
- Exercise: defining roles for audit and operations teams
Module 8: Elasticsearch REST API (3 hours)
- Fundamentals of the Elasticsearch RESTful API
- Executing GET and POST queries
- Performing manual and automated indexing
- Utilizing tools like curl and Postman
- Exercises: searching, inserting, deleting, and updating documents
Summary and Next Steps
Requirements
- A solid understanding of the basic ELK Stack architecture and its components
- Experience in ingesting and visualizing logs using Kibana and Logstash
- Familiarity with Linux command line operations and basic scripting
Audience
- System administrators
- Infrastructure engineers
- Technical teams looking to implement advanced log centralization capabilities
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from 4800 € + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
