Observability
Advanced Elasticsearch Query DSL and aggregations, with ES|QL
Write advanced Elasticsearch queries: bool, filter and score, nested, function_score and BM25 relevance, bucket, metric and pipeline aggregations, composi…
Guides & insights
A library for curious minds
Observability
Storing and querying telemetry directly in ClickHouse
Send logs and traces to ClickHouse with the OpenTelemetry exporter, understand the table schema, write analytical SQL queries, manage retention (TTL) and …
Observability
Mimir: the read path (query-frontend, querier, store-gateway and caches)
How Mimir answers a PromQL query: query-frontend splitting and caching, queue, queriers, store-gateway, index-headers and memcached caches.
Observability
TraceQL: the trace query language
Master TraceQL: span selectors, resource and span attributes, operators, duration comparisons, structural operators, aggregations and select.
Observability
LogQL (1/2): querying logs (selectors, filters and parsers)
Learn LogQL: stream selectors, line filters, json/logfmt/pattern/regexp parsers, label filters, line formatting and performance best practices.
Observability
Thanos Query and Query Frontend: a global, deduplicated view
Configure Thanos Query: StoreAPI endpoints, deduplication by replica label, partial response, web interface, Prometheus-compatible API, Query Frontend and…
Observability
PromQL: an introduction to the Prometheus query language
Learn PromQL, the Prometheus query language: selectors, rate, sum by, histograms and first queries, with examples you can try in the Prometheus web UI.
Observability
Transforms and enrich: summarising and enriching data in Elasticsearch
Build entity-centric indices with pivot and latest transforms, and enrich documents at ingest time with enrich policies, or at query time with ES|QL.
Observability
Elastic Security: SIEM, detection rules and investigation
Use Elastic Security as a SIEM: ECS data sources, detection rule types (query, EQL, ES|QL, threshold, indicator match, machine learning), prebuilt rules, …
Observability
Ingesting OpenTelemetry logs into Elasticsearch
Collect and structure logs with the OpenTelemetry Collector (filelog receiver, operators, transform processor, k8sattributes), ship them to Elasticsearch …
Observability
OpenTelemetry metrics in Elasticsearch
Collect host, Kubernetes and application metrics with OpenTelemetry, understand temporality and types, store them in time series data streams and query th…
Observability
Correlations in Grafana: jump from one data source to another
Create links between data sources in Explore: query and external correlations, variables, regex and logfmt transformations, creation in the UI or through …
Learning never stops