Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 14 hours
Course Outline
Day 1: Core Principles, Architectural Analysis, and Detailed Comparison (ELK vs. OpenSearch)
Morning Session: Fundamental Concepts & Architectural Overview
- Introduction & Historical Context:
- Origin of the ELK Stack (Elasticsearch, Logstash, Kibana)
- The 2021 fork: The rationale behind OpenSearch (shifts in AWS and Elastic licensing, Apache 2.0 contrasted with SSPL/Elastic License) - Internal Mechanics (Shared Heritage):
- Apache Lucene core engine: Shards, segments, inverted indices, and document persistence
- Distributed cluster topology: Nodes (Master, Data, Coordinator), cluster structure, and state management
- Fundamentals of Data Ingestion and Processing:
- Logstash pipelines, Beats, and contemporary alternatives (Fluentbit, OpenTelemetry/Data Prepper)
Afternoon Session: Feature Divergence & Ecosystem Variations
- Security & Enterprise Capability Comparison:
- Elasticsearch: Constraints on free-tier security versus paid capabilities (SSO, sophisticated alerting, machine learning, cross-cluster replication tiers)
- OpenSearch: Native, free fine-grained access control, internal user database, SAML/LDAP integration, and security add-ons - Interface & Query Languages:
- Kibana vs. OpenSearch Dashboards: Layout design, administrative tools, and developer experience
- Query Languages: Elasticsearch's ES|QL compared with OpenSearch's PPL (Piped Processing Language) and SQL support - Advanced Workloads (Vector Search & AI):
- HNSW implementations, k-NN search efficiency, and approaches to machine learning integration.
Day 2: Installation, Migration Methodologies, Operations, and Troubleshooting
Morning Session: Installation & Cluster Initialization
- Deploying OpenSearch:
- System prerequisites, kernel settings (vm.max_map_count), and JVM heap optimization
- Bare-metal/VM installation using tarballs and package managers
- Containerized deployment leveraging Docker and Docker Compose
- Multi-node cluster bootstrapping and security plugin activation (opensearch-security-install) - OpenSearch Dashboards Configuration:
- Establishing the connection between Dashboards and the OpenSearch cluster
- Setting up SSL/TLS certificates and authentication backends
Afternoon Session: Migration Pathways, Operations & Best Practices
- Migration Strategies (ELK to OpenSearch):
- Evaluating compatibility with current ES versions (optimal routes from pre-7.10/7.11 versus later releases)
- Snapshot & Restore Technique: Utilizing shared repository storage (AWS S3, NFS) for seamless data transfer
- Reindex-from-Remote & Logstash Rolling Migrations: Managing live data transitions with minimal downtime
- Adjustments to APIs and client SDKs (updating endpoints, connection strings, and client libraries) - Lifecycle Administration & Operational Distinctions:
- Elasticsearch ILM (Index Lifecycle Management) contrasted with OpenSearch ISM (Index State Management) syntax and policies
- Strategies for rollover, shrinking, downsampling, and index retention - Monitoring, Backup, and Troubleshooting:
- Utilizing cluster health APIs, statistics, and tracking shard allocation challenges
- Addressing common failure modes (circuit breaker exceptions, JVM garbage collection pauses, split-brain mitigation)
Q&A and Conclusion: An open forum for discussing specific organizational migration challenges and architectural reviews
Practical exercises and Hands-On Labs are central to this course. Participants will develop practical experience in OpenSearch deployment, configuration, data ingestion, security, migration, monitoring, and troubleshooting through realistic, industry-relevant scenarios.
Requirements
Candidates are expected to possess the following:
- Fundamental proficiency with Linux command-line interfaces.
- Knowledge of core networking principles, including TCP/IP, HTTP/HTTPS, and DNS.
- Basic comprehension of log management and monitoring frameworks.
- General awareness of container technologies (Docker) is advantageous, though not mandatory.
- Foundational experience with Elasticsearch or the broader ELK Stack.
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
