Course Outline
Introduction
- General overview of the Elastic Stack (ELK)
Module 1: ELK Stack Architecture and Review of Existing Environment
- Review of the current architecture of Altor CB
- Overview of ELK architecture: Elasticsearch, Logstash, Kibana, Beats
- Comparison: Ingest node vs. Logstash
- Scalability and performance considerations for on-premise installations
- Administration best practices
Module 2: Beats – Distributed Monitoring (2 hours)
- Configuration and application of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Secure data transmission using SSL
- Preconfigured modules versus custom inputs
- Integration with Logstash and Ingest Pipelines
Module 3: Parsing and Ingesting Logs from Applications and Databases (4 hours)
- Ingesting custom application logs
- Utilizing Logstash for data parsing and transformation
- Employment of filters: grok, dissect, kv, mutate, date
- Database connectivity (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
- Practical scenarios: error logs, audit trails, traces, slow queries
Module 4: Advanced Search and Regular Expressions (2 hours)
- Advanced search syntax within Kibana
- Application of regular expressions (regex)
- Filters and OR/AND logical combinations
- Nested fields and arrays
- Saving reusable queries and filters
Module 5: Custom Dashboards and Visualizations in Kibana (3 hours)
- Visualization types: bar, line, maps, tables
- Aggregations and metrics
- Dynamic filters, controls, and drill-down features
- Dashboard sharing capabilities
- Exercises: building dashboards from database and system logs
Module 6: Alerts and Email Notifications (3 hours)
- Introduction to Watcher and alternative tools (ElastAlert, Kibana Alerts)
- Establishing custom conditions and triggers
- Configuring email output
- Exercise: triggering an alert upon detection of a critical event in Windows or database logs
Module 7: User and Permission Management (2 hours)
- Introduction to X-Pack and free alternatives
- Creating users and roles
- Access control based on index, dashboard, and query
- Exercise: defining roles for audit and operations
Module 8: Elasticsearch REST API (3 hours)
- Foundations of the Elasticsearch RESTful API
- GET and POST queries
- Manual and automated indexing procedures
- Utilizing tools such as curl and Postman
- Exercises: searching, inserting, deleting, and updating documents
Summary and Next Steps
Requirements
- A fundamental understanding of ELK Stack architecture and its components
- Practical experience with log ingestion and visualization using Kibana and Logstash
- Familiarity with the Linux command line and basic scripting
Target Audience
- System administrators
- Infrastructure engineers
- Technical teams aiming to enhance their log centralization capabilities
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
