Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction
- General perspective on the Elastic Stack (ELK)
ELK Stack Architecture and Current Environment Assessment
- Assessment of Altor CB's existing architecture
- Core ELK components: Elasticsearch, Logstash, Kibana, and Beats
- Distinguishing between Ingest nodes and Logstash
- Scalability and performance factors in on-premise deployments
- Best practices for administration
Beats – Distributed Monitoring Solutions
- Configuration and deployment of Filebeat, Auditbeat, Winlogbeat, and Packetbeat
- Implementing secure data transmission via SSL
- Comparing preconfigured modules with custom input sources
- Integration strategies with Logstash and Ingest Pipelines
Log Parsing and Ingestion from Applications and Databases
- Ingestion of custom application logs
- Leveraging Logstash for data parsing and transformation processes
- Application of filters: grok, dissect, kv, mutate, and date
- Database connectivity (Oracle, PostgreSQL, SQL Server) via the JDBC input plugin
- Practical scenarios: handling error logs, audit trails, traces, and slow queries
Advanced Search Techniques and Regular Expressions
- Complex search syntax within Kibana
- Application of regular expressions (regex)
- Constructing filters using OR/AND logic combinations
- Navigating nested fields and arrays
- Storing reusable queries and filter configurations
Custom Dashboards and Visualizations in Kibana
- Exploring visualization types: bar charts, line graphs, maps, and tables
- Utilizing aggregations and key metrics
- Implementing dynamic filters, controls, and drill-down capabilities
- Strategies for dashboard sharing
- Practical exercises: building dashboards from database and system logs
Alerting Mechanisms and Email Notifications
- Overview of Watcher and alternative tools (ElastAlert, Kibana Alerts)
- Defining custom conditions and trigger events
- Configuring email output channels
- Hands-on exercise: triggering alerts upon detecting critical events in Windows or database logs
User and Permission Administration
- Introduction to X-Pack features and available free options
- Creating and managing users and roles
- Access control tailored to indices, dashboards, and specific queries
- Exercise: establishing roles for audit and operations teams
Elasticsearch REST API
- Foundational concepts of the Elasticsearch RESTful API
- Executing GET and POST queries
- Manual and automated indexing procedures
- Leveraging tools such as curl and Postman
- Practical exercises: searching, inserting, deleting, and updating documents
Requirements
- A solid grasp of fundamental ELK Stack architecture and its core components
- Hands-on experience with log ingestion and visualization using Kibana and Logstash
- Proficiency with the Linux command line and basic scripting principles
Target Audience
- System administrators
- Infrastructure engineers
- Technical teams aiming to enhance their log centralization capabilities
Testimonials (2)
The theoretical material shown and the detail of the practices
CESAR - ALTOR CASA DE BOLSA
Course - Advanced ELK Stack for Log Management and Centralization
Machine Translated
the teachers' attitude of wanting to help us with our doubts
Roberto - ALTOR CASA DE BOLSA
Course - Advanced ELK Stack for Log Management and Centralization
Machine Translated
