Observability
Beats: Filebeat, Metricbeat, Winlogbeat and their configuration
Written version of the video lessons: role of each Beat, configuration structure, inputs, modules, processors, outputs and the setup command.
Guides & insights
A library for curious minds
Observability
Other log sources and queues: syslog, Fluent Bit, Kafka, Redis
Written version of the video lessons: collect syslog, Fluent Bit and other sources, then insert a queue (Kafka, Redis, RabbitMQ) between collection and in…
Observability
Logstash: role, pipeline concept and installation
Written version of the video lessons: what Logstash is for, how a pipeline works (inputs, filters, outputs, queue, workers) and how to install it.
Observability
Logstash: inputs and outputs
Written version of the video lessons: common inputs (beats, file, tcp/udp, http, kafka, jdbc) and outputs (elasticsearch with data streams, file, s3, kafk…
Observability
Logstash: filters, grok and dissect
Written version of the video lessons: essential filters (mutate, date, json, kv, drop), the grok plugin and its patterns, dissect, and how to choose betwe…
Observability
Logstash: managing plugins and adopting Elastic Common Schema (ECS)
Written version of the video lessons: list, install, update and bundle Logstash plugins offline; understand ECS, ecs_compatibility mode and naming your fi…
Observability
Kibana Maps and Canvas: geographic maps and presentations
Build maps with Kibana Maps (document, aggregation and choropleth layers, ES|QL) and dynamic presentations with Canvas (elements, Elasticsearch SQL, expre…
Observability
Logstash in production: persistent queues, DLQ and multiple pipelines
Make Logstash reliable in production: persistent queue, dead letter queue, multiple pipelines and pipeline-to-pipeline, tuning workers and the JVM.
Observability
Logstash: enrich, test, monitor and deploy on Kubernetes
Enrich with translate, geoip and elasticsearch, consume Kafka, test pipelines, monitor Logstash and deploy it on Kubernetes with ECK.
Observability
Transforms and enrich: summarising and enriching data in Elasticsearch
Build entity-centric indices with pivot and latest transforms, and enrich documents at ingest time with enrich policies, or at query time with ES|QL.
Observability
Machine learning in Elastic: anomaly detection and AIOps
Automatically detect abnormal behaviour: anomaly detection jobs, datafeeds, detectors, influencers, alerts, forecasts, log analysis (AIOps) and data frame…
Observability
Elastic Security: SIEM, detection rules and investigation
Use Elastic Security as a SIEM: ECS data sources, detection rule types (query, EQL, ES|QL, threshold, indicator match, machine learning), prebuilt rules, …
Learning never stops