Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
Open-Source Search and Analytics Sovereignty
- Understanding Elastic license changes and subsequent forks.
- Feature parity between OpenSearch and Elasticsearch for 2025-2026.
- Key use cases: enterprise search, log analytics, SIEM, and observability.
Cluster Architecture
- Node roles: master, data, coordinating, and ingest nodes.
- Security plugin configuration: TLS internode communication, certificates, and PKI.
- Avoiding split-brain scenarios using discovery.seed_hosts and minimum_master_nodes settings.
Data Ingestion
- REST API indexing, bulk loading operations, and mapping definitions.
- Pipelines utilizing Beats, Fluent Bit, and Logstash.
- Utilizing the OpenTelemetry Collector for traces and metrics.
Search and Dashboards
- Query DSL: match, term, range queries, aggregations, and nested fields.
- Visualizing data and building dashboards in OpenSearch Dashboards.
- SIEM applications: configuring alert rules and anomaly detection.
Index Management
- ILM capabilities: rollover, shrinking, and deletion processes.
- Implementing hot-warm-cold architecture.
- Optimizing mappings and text analysis.
Security and Access Control
- RBAC implementation involving users, roles, and tenants.
- SAML and OpenID Connect authentication methods.
- Document-level security and field masking techniques.
Backup and Recovery
- Configuring snapshot repositories for MinIO, S3, or NFS.
- Automating snapshots using Curator or ISM.
- Restoring specific indices and ensuring cluster-wide disaster recovery (DR).
Requirements
- Familiarity with search engines and inverted indexes.
- Experience working with REST APIs and JSON.
- Basic Linux administration skills: systemd, logs, package management.
Audience
- Engineers specializing in search and log analytics.
- Teams seeking to replace managed Elasticsearch or Splunk solutions.
- Security analysts constructing sovereign SIEM backends.
14 Hours
Testimonials (1)
the trainer was very good and made the training perfect for my needs
