Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 14 hours
Course Outline
Sovereignty in Open-Source Search and Analytics
- Elastic license modifications and the emergence of forks.
- Feature comparison between OpenSearch and Elasticsearch in the 2025-2026 landscape.
- Key use cases: enterprise search, log analytics, SIEM, and observability.
Cluster Architecture
- Node roles: master, data, coordinating, and ingest nodes.
- Security plugin configuration: TLS for internode communication, certificates, and PKI.
- Preventing split-brain scenarios via discovery.seed_hosts and minimum master node settings.
Data Ingestion
- Indexing via REST API, bulk loading techniques, and defining mappings.
- Utilizing Beats, Fluent Bit, and Logstash pipelines.
- Implementing the OpenTelemetry Collector for traces and metrics.
Search and Dashboards
- Query DSL essentials: match, term, range, aggregations, and nested fields.
- Developing visualizations and dashboards in OpenSearch Dashboards.
- SIEM applications: configuring alert rules and anomaly detection.
Index Management
- Index Lifecycle Management (ILM): rollover, shrinking, and deletion strategies.
- Implementing hot-warm-cold architectures.
- Optimizing mappings and text analysis.
Security and Access Control
- Implementing RBAC through users, roles, and tenants.
- Authentication using SAML and OpenID Connect.
- Enforcing document-level security and field masking.
Backup and Recovery
- Configuring snapshot repositories on MinIO, S3, or NFS.
- Automating snapshots using Curator or ISM.
- Restoring specific indices and executing cluster-wide disaster recovery.
Requirements
- Familiarity with search engines and the concept of inverted indexes.
- Working experience with REST APIs and JSON structures.
- Foundational knowledge of Linux administration, including systemd, logging, and package management.
Target Audience
- Search and log analytics engineers.
- Teams seeking to replace managed Elasticsearch or Splunk solutions.
- Security analysts developing sovereign SIEM backends.
Testimonials (1)
the trainer was very good and made the training perfect for my needs
