Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- Comprehensive overview of the Elastic Stack (ELK)
ELK Stack Architecture and Current Environment Review
- Assessment of the existing Altor CB architecture
- Core ELK components: Elasticsearch, Logstash, Kibana, and Beats
- Distinguishing between Ingest nodes and Logstash
- Considerations for scalability and performance in on-premise deployments
- Best practices for administration
Beats – Distributed Monitoring
- Configuration and deployment of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Ensuring secure data transmission via SSL
- Comparing preconfigured modules with custom inputs
- Integration strategies with Logstash and Ingest Pipelines
Parsing and Ingesting Logs from Applications and Databases
- Processing custom logs from application sources
- Leveraging Logstash for data parsing and transformation
- Application of filters: grok, dissect, kv, mutate, and date
- Establishing database connections (Oracle, PostgreSQL, SQL Server) using the JDBC input plugin
- Practical scenarios: analyzing error logs, audit trails, traces, and slow queries
Advanced Search and Regular Expressions
- Mastering advanced search syntax in Kibana
- Application of regular expressions (regex)
- Complex filtering using OR/AND combinations
- Handling nested fields and array structures
- Saving queries and filters for reuse
Custom Dashboards and Visualizations in Kibana
- Exploring visualization types: bar charts, line graphs, maps, and tables
- Utilizing aggregations and key metrics
- Implementing dynamic filters, controls, and drill-down capabilities
- Sharing dashboards across teams
- Practical exercises: constructing dashboards from database and system logs
Alerts and Email Notifications
- Overview of Watcher and alternatives such as ElastAlert and Kibana Alerts
- Defining custom conditions and triggers
- Configuring email output settings
- Exercise: configuring alerts for critical events detected in Windows or database logs
User and Permission Management
- Introduction to X-Pack features and available free options
- Creation and management of users and roles
- Granular access control at the index, dashboard, and query levels
- Exercise: defining specific roles for audit and operations teams
Elasticsearch REST API
- Foundational concepts of the Elasticsearch RESTful API
- Executing GET and POST queries
- Managing manual and automated indexing
- Utilization of tools such as curl and Postman
- Exercises: searching, inserting, deleting, and updating documents
Requirements
- A solid understanding of basic ELK Stack architecture and its components
- Practical experience with ingesting and visualizing logs using Kibana and Logstash
- Proficiency with the Linux command line and basic scripting
Target Audience
- System administrators
- Infrastructure engineers
- Technical teams aiming to enhance their log centralization capabilities
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
