Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- General overview of the Elastic Stack (ELK).
ELK Stack Architecture and Review of Existing Environment
- Review of the current architecture of Altor CB.
- ELK architecture components: Elasticsearch, Logstash, Kibana, and Beats.
- Comparison of Ingest nodes versus Logstash.
- Scalability and performance considerations for on-premise installations.
- Administration best practices.
Beats – Distributed Monitoring
- Configuration and utilization of Filebeat, Auditbeat, Winlogbeat, and Packetbeat.
- Secure data shipping via SSL.
- Distinguishing between preconfigured modules and custom inputs.
- Integration with Logstash and Ingest Pipelines.
Parsing and Ingesting Logs from Applications and Databases
- Ingesting custom logs from various applications.
- Employing Logstash for data parsing and transformation.
- Applying filters: grok, dissect, kv, mutate, and date.
- Establishing database connections (Oracle, PostgreSQL, SQL Server) using the JDBC input plugin.
- Practical case studies: error logs, audit trails, traces, and slow queries.
Advanced Search and Regular Expressions
- Advanced search syntax within Kibana.
- Application of regular expressions (regex).
- Utilizing filters and OR/AND combinations.
- Handling nested fields and arrays.
- Saving reusable queries and filters.
Custom Dashboards and Visualizations in Kibana
- Types of visualizations: bar, line, maps, and tables.
- Utilizing aggregations and metrics.
- Implementing dynamic filters, controls, and drill-down features.
- Dashboard sharing capabilities.
- Exercises: Creating dashboards derived from database and system logs.
Alerts and Email Notifications
- Introduction to Watcher and alternatives such as ElastAlert and Kibana Alerts.
- Defining custom conditions and triggers.
- Configuring email output.
- Exercise: Sending alerts upon detection of critical events in Windows or database logs.
User and Permission Management
- Introduction to X-Pack and available free options.
- Creation of users and roles.
- Access control by index, dashboard, and query.
- Exercise: Defining roles for audit and operations.
Elasticsearch REST API
- Foundations of the Elasticsearch RESTful API.
- Executing GET and POST queries.
- Manual and automated indexing processes.
- Utilizing tools such as curl and Postman.
- Exercises: Searching, inserting, deleting, and updating documents.
Requirements
- A foundational understanding of the basic ELK Stack architecture and its components.
- Experience in ingesting and visualizing logs using Kibana and Logstash.
- Familiarity with the Linux command line and basic scripting.
Audience
- System administrators.
- Infrastructure engineers.
- Technical teams seeking advanced log centralization capabilities.
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
