RousselTMLEARNING
EN
FrançaisEnglishEspañol
Sign in

Observabilité · Courses

Elasticsearch: from discovery to expertise

Discover everything you need to know about deploying, configuring and administering an Elasticsearch cluster.

10 chapters44 lessonsEN
At your pace, through practice.

By the end of this course you will be able to

  • Install an Elasticsearch cluster and index documents
  • Write efficient search and aggregation queries
  • Manage index lifecycle (ILM) and backups
  • Detect changes with alerts
  • Design mappings, ingest pipelines, data streams and ILM policies
  • Troubleshoot and size a cluster
  • Implement vector and hybrid search
  • Deploy and automate Elasticsearch (ECK, Terraform)

🎯 Level : Intermediate👥 Who it is for : Developers, data engineers and operators who index and search data

LEARNING PATH

Course curriculum

0Training overview1 lesson
  1. Assessment quizQuiz · ⏱ 10 min
1Fundamentals and architecture9 lessons

Installation, Lucene, nodes, shards, replicas and allocation.

  1. IntroductionLesson · ⏱ 6 min
  2. Elastic architecture and best practicesLesson · ⏱ 18 min
  3. InstallationLesson · ⏱ 4 min
  4. NoSQL databases, indices, shards and Apache LuceneLesson · ⏱ 11 min
  5. Index - best practicesLesson · ⏱ 11 min
  6. Kibana installationLesson · ⏱ 4 min
  7. Setting up the test environmentHands-on lab · ⏱ 28 min · Level 1/5
  8. Elasticsearch installationHands-on lab · ⏱ 15 min · Level 1/5
  9. Advanced distributed architectureArticle · ⏱ 5 min
2Cluster administration6 lessons

Cluster APIs, licensing, monitoring, troubleshooting and performance.

  1. Licensing: Elasticsearch license modelsLesson · ⏱ 6 min
  2. Testing queries and configurations with Kibana Dev ToolsLesson · ⏱ 9 min
  3. Retrieving cluster informationHands-on lab · ⏱ 56 min · Level 3/5
  4. License managementHands-on lab · ⏱ 28 min · Level 1/5
  5. Monitoring and troubleshootingArticle · ⏱ 3 min
  6. Performance and capacity planningArticle · ⏱ 3 min
3Data management and ingestion6 lessons

Indices, mappings, pipelines, data streams and ILM.

  1. IndicesHands-on lab · ⏱ 42 min · Level 3/5
  2. TemplatesHands-on lab · ⏱ 15 min · Level 3/5
  3. Mappings and text analysisArticle · ⏱ 5 min
  4. Ingestion and ingest pipelinesArticle · ⏱ 6 min
  5. Data streams and templatesArticle · ⏱ 4 min
  6. Index Lifecycle Management (ILM)Article · ⏱ 3 min
4Security and access8 lessons

Users, roles, spaces, TLS, API keys and audit.

  1. Kibana spaces: hidden or disabled featuresLesson · ⏱ 8 min
  2. Security: users, roles and API keys (reserved and deprecated roles)Lesson · ⏱ 14 min
  3. External users and roles: Role MappingLesson · ⏱ 12 min
  4. Space managementHands-on lab · ⏱ 35 min · Level 2/5
  5. Users and rolesHands-on lab · ⏱ 42 min · Level 3/5
  6. API keysHands-on lab · ⏱ 15 min · Level 3/5
  7. Role mappingsHands-on lab · ⏱ 28 min · Level 4/5
  8. Advanced securityArticle · ⏱ 4 min
5Search and analytics6 lessons

Query DSL, ES|QL, aggregations, Kibana and vector search.

  1. Query languages: Query DSL, KQL and ES|QLLesson · ⏱ 21 min
  2. Filter your documentsHands-on lab · ⏱ 56 min · Level 3/5
  3. SearchingHands-on lab · ⏱ 49 min · Level 4/5
  4. Advanced Query DSL and aggregationsArticle · ⏱ 6 min
  5. Advanced KibanaArticle · ⏱ 3 min
  6. Vector search and RAGArticle · ⏱ 4 min
6Change detection1 lesson

Alerting, Watcher and anomaly detection.

  1. Change detectionHands-on lab · ⏱ 56 min · Level 4/5
7Backup and resilience3 lessons

Snapshots, SLM, disaster recovery and multi-cluster.

  1. Backup and restoreHands-on lab · ⏱ 1 h 10 · Level 4/5
  2. Snapshot Lifecycle ManagementArticle · ⏱ 4 min
  3. Cross-cluster search and replicationArticle · ⏱ 5 min
8Kubernetes and automation2 lessons

ECK, Terraform, Ansible and CI/CD.

  1. Elasticsearch on Kubernetes with ECKArticle · ⏱ 6 min
  2. Automation and infrastructure as codeArticle · ⏱ 6 min
9Best practices and final project2 lessons

Production operations and validation project.

  1. Elasticsearch best practicesArticle · ⏱ 12 min
  2. Final project: run a simulated production Elasticsearch clusterHands-on lab · ⏱ 3 h · Level 5/5

LEARN BY DOING

Use cases & applications

Text search engine

Implement ultra-fast full-text search over product or document catalogues.

Centralised log analysis

Ingest, index and analyse massive volumes of logs with the ELK stack.

Security monitoring (SIEM)

Use Elasticsearch for threat detection and security event analysis.

Analytical dashboards

Visualise real-time metrics with the Kibana interface.

Geospatial analysis

Store geographic coordinates and run proximity queries.

Machine Learning application

Detect anomalies in time series directly within the cluster.

What next?

Logstash: from discovery to expertiseBeats: From Discovery to ExpertiseKibana and Elastic Observability: from discovery to expertise

Frequently asked questions

What is Elasticsearch?

A distributed search and analytics engine based on Apache Lucene.

What is an index?

A logical collection of JSON documents, split into shards (Lucene indices) spread across the cluster's nodes. It is not the equivalent of a relational database: no tables or joins, and one schema (mapping) per index.

How does a Shard work?

It is a partition of an index that lets data be distributed across several nodes.

What is Kibana used for?

It is the user interface for visualising and interacting with Elasticsearch data.

How do you secure the cluster?

By using Role-Based Access Control (RBAC) features and Kibana spaces.

What is the default query language?

You can use Query DSL through the API, or KQL (Kibana Query Language) in the interface.

Is it suitable for time series?

Yes, through Data Streams, which are optimised for time-based data.

How do you manage backups?

With Snapshots stored in a repository (NFS, S3, etc.) and managed by SLM policies.

Can an LDAP or Active Directory directory be integrated?

Yes, Elasticsearch supports Role Mapping with SAML, LDAP and other identity providers.

What is a Master node?

A node responsible for managing the cluster as a whole (index creation, node tracking).