Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- Broad overview of the Elastic Stack (ELK).
ELK Stack Architecture and Environmental Review
- Assessment of the current Altor CB architecture.
- Core ELK components: Elasticsearch, Logstash, Kibana, and Beats.
- Distinguishing between Ingest nodes and Logstash.
- Scalability and performance optimisation for on-premise deployments.
- Administration best practices.
Beats for Distributed Monitoring
- Configuration and application of Filebeat, Auditbeat, Winlogbeat, and Packetbeat.
- Securing data transmission with SSL.
- Comparing preconfigured modules with custom inputs.
- Integration with Logstash and Ingest Pipelines.
Parsing and Ingesting Logs from Applications and Databases
- Capturing custom logs from application sources.
- Utilising Logstash for data parsing and transformation.
- Application of filters including grok, dissect, kv, mutate, and date.
- Establishing database connections (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin.
- Practical scenarios: error logs, audit trails, traces, and slow queries.
Advanced Search Techniques and Regular Expressions
- Mastery of advanced Kibana search syntax.
- Implementation of regular expressions (regex).
- Construction of filters and logical OR/AND combinations.
- Handling nested fields and arrays.
- Saving and reusing queries and filters.
Custom Dashboards and Visualisations in Kibana
- Exploration of visualisation types: bar charts, line graphs, maps, and tables.
- Utilisation of aggregations and metrics.
- Employment of dynamic filters, controls, and drill-down features.
- Dashboard sharing protocols.
- Practical exercises: constructing dashboards from database and system logs.
Alerting and Email Notifications
- Overview of Watcher and alternative solutions such as ElastAlert and Kibana Alerts.
- Defining custom conditions and triggers.
- Configuration of email output channels.
- Exercise: triggering alerts upon the detection of critical events in Windows or database logs.
User and Permission Management
- Introduction to X-Pack features and available free options.
- Creation and management of users and roles.
- Enforcement of access controls across indexes, dashboards, and queries.
- Exercise: defining specific roles for audit and operations teams.
Elasticsearch REST API
- Foundations of the Elasticsearch RESTful API.
- Execution of GET and POST requests.
- Techniques for manual and automated indexing.
- Utilisation of tools such as curl and Postman.
- Exercises: performing searches, insertions, deletions, and document updates.
Requirements
- A solid understanding of the fundamental ELK Stack architecture and its core components.
- Practical experience in ingesting and visualising logs using Kibana and Logstash.
- Proficiency with the Linux command line and basic scripting capabilities.
Intended Audience
- System administrators.
- Infrastructure engineers.
- Technical teams aiming to implement advanced log centralisation strategies.
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
