Get in Touch
 Duration 21 hours

Course Outline

Introduction

  • Broad overview of the Elastic Stack (ELK)

ELK Stack Architecture and Review of Existing Environment

  • Analysis of the current Altor CB architecture
  • ELK architecture components: Elasticsearch, Logstash, Kibana, and Beats
  • Comparison between Ingest nodes and Logstash
  • Scalability and performance factors in on-premise setups
  • Best practices for administration

Beats – Distributed Monitoring

  • Configuring and utilizing Filebeat, Auditbeat, Winlogbeat, and Packetbeat
  • Secure data transmission using SSL
  • Premodules versus custom inputs
  • Integration strategies with Logstash and Ingest Pipelines

Parsing and Ingesting Logs from Applications and Databases

  • Collecting custom logs from various applications
  • Employing Logstash for data parsing and transformation
  • Applying filters such as grok, dissect, kv, mutate, and date
  • Establishing database connections (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
  • Practical scenarios: error logs, audit trails, traces, and slow queries

Advanced Search and Regular Expressions

  • Advanced search syntax within Kibana
  • Application of regular expressions (regex)
  • Combining filters with OR/AND logic
  • Handling nested fields and arrays
  • Storing reusable queries and filter sets

Custom Dashboards and Visualizations in Kibana

  • Visualization options: bar charts, line graphs, maps, and tables
  • Utilizing aggregations and metrics
  • Dynamic filters, controls, and drill-down functionalities
  • Dashboard sharing protocols
  • Hands-on exercises: building dashboards from database and system logs

Alerts and Email Notifications

  • Overview of Watcher and alternatives like ElastAlert and Kibana Alerts
  • Defining custom conditions and triggers
  • Configuring email outputs
  • Exercise: triggering alerts upon detecting critical events in Windows or database logs

User and Permission Management

  • Introduction to X-Pack and available free features
  • Creating user accounts and roles
  • Access control based on indices, dashboards, and queries
  • Exercise: defining roles for audit and operational teams

Elasticsearch REST API

  • Basics of the Elasticsearch RESTful API
  • Executing GET and POST queries
  • Manual and automated indexing processes
  • Utilizing tools such as curl and Postman
  • Exercises: searching, inserting, deleting, and updating documents

Requirements

  • A solid grasp of the fundamental ELK Stack architecture and its components
  • Practical experience in ingesting and visualizing logs via Kibana and Logstash
  • Proficiency with the Linux command line and basic scripting tasks

Target Audience

  • System administrators
  • Infrastructure engineers
  • Technical teams aiming to enhance their log centralization capabilities

Number of participants


Price per participant

Testimonials (2)

Upcoming Courses

Related Categories