Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- Broad overview of the Elastic Stack (ELK)
ELK Stack Architecture and Current Environment Review
- Assessment of Altor CB's existing architecture
- ELK components: Elasticsearch, Logstash, Kibana, and Beats
- Distinguishing between Ingest nodes and Logstash
- Addressing scalability and performance in on-premise setups
- Reviewing administration best practices
Beats: Distributed Monitoring
- Configuring and deploying Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Securing data transmission using SSL
- Choosing between preconfigured modules and custom inputs
- Integrating with Logstash and Ingest Pipelines
Parsing and Ingesting Logs from Applications and Databases
- Collecting custom logs from application layers
- Leveraging Logstash for data parsing and transformation
- Applying filters such as grok, dissect, kv, mutate, and date
- Establishing database connections (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
- Practical scenarios covering error logs, audit trails, traces, and slow queries
Advanced Search and Regular Expressions
- Exploring advanced search syntax in Kibana
- Implementing regular expressions (regex)
- Constructing complex filters using OR/AND logic
- Handling nested fields and arrays
- Storing reusable queries and filter combinations
Custom Dashboards and Visualizations in Kibana
- Exploring visualization options: bar, line, maps, and tables
- Utilizing aggregations and metrics
- Implementing dynamic filters, controls, and drill-down capabilities
- Sharing dashboards with stakeholders
- Exercises: building dashboards from database and system logs
Alerts and Email Notifications
- Overview of Watcher and alternatives like ElastAlert and Kibana Alerts
- Defining custom conditions and triggers
- Configuring email output settings
- Exercise: triggering alerts upon detecting critical events in Windows or database logs
User and Permission Management
- Introduction to X-Pack and available free-tier options
- Creating and managing users and roles
- Implementing access controls across indices, dashboards, and queries
- Exercise: defining specific roles for audit and operations teams
Elasticsearch REST API
- Fundamentals of the Elasticsearch RESTful API
- Executing GET and POST queries
- Performing manual and automated indexing
- Utilizing tools such as curl and Postman
- Exercises: searching, inserting, deleting, and updating documents
Requirements
- A solid grasp of fundamental ELK Stack architecture and its core components
- Practical experience in ingesting and visualizing logs via Kibana and Logstash
- Proficiency in the Linux command line and basic scripting
Target Audience
- System administrators
- Infrastructure engineers
- Technical teams looking to enhance their log centralization capabilities
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
