Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- Comprehensive overview of the Elastic Stack (ELK)
ELK Stack Architecture and Review of Existing Environment
- Assessment of Altor CB's current architecture
- ELK architecture components: Elasticsearch, Logstash, Kibana, and Beats
- Distinguishing between Ingest nodes and Logstash
- Scalability and performance considerations for on-premise deployments
- Administrative best practices
Beats – Distributed Monitoring
- Configuration and application of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Secure data transmission using SSL
- Comparison of preconfigured modules versus custom inputs
- Integration with Logstash and Ingest Pipelines
Parsing and Ingesting Logs from Applications and Databases
- Ingestion of custom logs from application sources
- Utilizing Logstash for data parsing and transformation processes
- Application of filters: grok, dissect, kv, mutate, and date
- Establishing database connections (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
- Practical scenarios: analyzing error logs, audit trails, traces, and slow queries
Advanced Search and Regular Expressions
- Advanced search syntax techniques in Kibana
- Application of regular expressions (regex)
- Utilizing filters and OR/AND logical combinations
- Handling nested fields and arrays
- Saving queries and filters for reuse
Custom Dashboards and Visualizations in Kibana
- Exploring visualization types: bar charts, line graphs, maps, and tables
- Implementing aggregations and metrics
- Using dynamic filters, controls, and drill-down functionalities
- Sharing dashboards with relevant stakeholders
- Practical exercises: constructing dashboards based on database and system logs
Alerts and Email Notifications
- Overview of Watcher and alternative solutions (ElastAlert, Kibana Alerts)
- Defining custom conditions and triggers
- Configuring email output settings
- Practical exercise: generating alerts upon detection of critical events in Windows or database logs
User and Permission Management
- Introduction to X-Pack features and available free options
- Creating users and defining roles
- Implementing access controls at the index, dashboard, and query levels
- Practical exercise: defining roles for audit and operations teams
Elasticsearch REST API
- Foundations of the Elasticsearch RESTful API
- Executing GET and POST queries
- Performing manual and automated indexing
- Utilizing tools such as curl and Postman
- Practical exercises: searching, inserting, deleting, and updating documents
Requirements
- A solid understanding of the fundamental ELK Stack architecture and its components
- Practical experience in ingesting and visualizing logs using Kibana and Logstash
- Proficiency with the Linux command line and basic scripting concepts
Target Audience
- System Administrators
- Infrastructure Engineers
- Technical teams aiming to achieve advanced capabilities in log centralization
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
