Observability
Logstash: role, pipeline concept and installation
Written version of the video lessons: what Logstash is for, how a pipeline works (inputs, filters, outputs, queue, workers) and how to install it.
Guides & insights
A library for curious minds
Observability
Logstash: inputs and outputs
Written version of the video lessons: common inputs (beats, file, tcp/udp, http, kafka, jdbc) and outputs (elasticsearch with data streams, file, s3, kafk…
Observability
Logstash: filters, grok and dissect
Written version of the video lessons: essential filters (mutate, date, json, kv, drop), the grok plugin and its patterns, dissect, and how to choose betwe…
Observability
Logstash: managing plugins and adopting Elastic Common Schema (ECS)
Written version of the video lessons: list, install, update and bundle Logstash plugins offline; understand ECS, ecs_compatibility mode and naming your fi…
Observability
Logstash in production: persistent queues, DLQ and multiple pipelines
Make Logstash reliable in production: persistent queue, dead letter queue, multiple pipelines and pipeline-to-pipeline, tuning workers and the JVM.
Observability
Logstash: enrich, test, monitor and deploy on Kubernetes
Enrich with translate, geoip and elasticsearch, consume Kafka, test pipelines, monitor Logstash and deploy it on Kubernetes with ECK.
Observability
Standalone Elastic Agent, Logstash and Kafka outputs, and OpenTelemetry (EDOT)
Write a standalone configuration, ship to Logstash or Kafka, and use Elastic Agent as an OpenTelemetry Collector (EDOT distribution) to collect logs, metr…
Observability
Logstash best practices: pipelines, performance, reliability and monitoring
Logstash best practices: multiple pipelines, dissect rather than grok, conditionals, persistent queue, dead letter queue, workers/batch settings, JVM, sec…
Observability
Transforms and enrich: summarising and enriching data in Elasticsearch
Build entity-centric indices with pivot and latest transforms, and enrich documents at ingest time with enrich policies, or at query time with ES|QL.
Observability
Machine learning in Elastic: anomaly detection and AIOps
Automatically detect abnormal behaviour: anomaly detection jobs, datafeeds, detectors, influencers, alerts, forecasts, log analysis (AIOps) and data frame…
Observability
Elastic Security: SIEM, detection rules and investigation
Use Elastic Security as a SIEM: ECS data sources, detection rule types (query, EQL, ES|QL, threshold, indicator match, machine learning), prebuilt rules, …
Observability
Elastic path project: centralising and using logs
The validation project of the "Elastic Stack mastery" path: Elastic Agent and Fleet, Logstash, Elasticsearch (data streams, ILM), Kibana (ES|QL, Lens, ale…
Learning never stops