Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- General overview of the Elastic Stack (ELK)
ELK Stack Architecture and Current Environment Review
- Review of Altor CB’s current architecture
- Overview of ELK components: Elasticsearch, Logstash, Kibana, Beats
- Comparison of Ingest nodes versus Logstash
- Scalability and performance strategies for on-premise deployments
- Administration best practices
Beats – Distributed Monitoring
- Configuring and utilizing Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Secure data shipping via SSL
- Preconfigured modules versus custom inputs
- Integration with Logstash and Ingest Pipelines
Parsing and Ingesting Logs from Applications and Databases
- Ingesting custom logs from various applications
- Leveraging Logstash for data parsing and transformation
- Utilizing filters: grok, dissect, kv, mutate, date
- Connecting to databases (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
- Practical scenarios: error logs, audit trails, traces, and slow queries
Advanced Search and Regular Expressions
- Advanced search syntax in Kibana
- Application of regular expressions (regex)
- Using filters and OR/AND logical combinations
- Handling nested fields and arrays
- Saving reusable queries and filters
Custom Dashboards and Visualizations in Kibana
- Visualization types: bar charts, line graphs, maps, tables
- Aggregations and metrics calculation
- Implementing dynamic filters, controls, and drill-down features
- Dashboard sharing workflows
- Practical exercises: building dashboards from database and system logs
Alerts and Email Notifications
- Introduction to Watcher and alternatives (ElastAlert, Kibana Alerts)
- Defining custom conditions and triggers
- Configuring email output
- Exercise: triggering alerts upon detection of critical events in Windows or database logs
User and Permission Management
- Overview of X-Pack and available free options
- Creating users and defining roles
- Access control based on index, dashboard, and query level
- Exercise: establishing roles for audit and operations teams
Elasticsearch REST API
- Foundations of the Elasticsearch RESTful API
- Executing GET and POST queries
- Manual and automated indexing processes
- Utilizing tools such as curl and Postman
- Exercises: searching, inserting, deleting, and updating documents
Requirements
- A solid grasp of basic ELK Stack architecture and its core components
- Practical experience in ingesting and visualizing logs using Kibana and Logstash
- Familiarity with the Linux command line and basic scripting
Target Audience
- System administrators
- Infrastructure engineers
- Technical teams aiming to advanced log centralization capabilities
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
