Lab: Install Kibana and explore logs with KQL

What you will learn in this TP

• Install the stack locally
• Load a dataset
• Write KQL queries

Introduction #

What you will learn in this section

• Install the stack locally
• Load a dataset
• Write KQL queries

Context. You are joining a team that uses the Elastic Stack. Before working on the real logs, you learn to search efficiently on a sample dataset.

Prerequisites: Docker, 4 GB of free RAM  ·  Estimated time: 35 min

Search logs efficiently.

Setup #

Guided steps, with their solutions.

1. 1. Start the stack

   Why? The official script sets up security and a trial licence: every feature is available for the labs.

   Run start-local and retrieve the password of the elastic user.

2. 2. Load the sample data

   Why? The “web logs” dataset contains realistic access logs over several weeks, with a data view and a dashboard.

   Install it through the API (or from the Kibana home page).

3. 3. Discover the fields

   Why? Knowing which fields are available is the prerequisite for any query.

   Open Discover on the Kibana Sample Data Logs data view (last 7 days). What are the 5 most frequent source countries (geo.src)?

4. 4. KQL queries

   Why? Each query answers a concrete operational question.

   Find: (1) the 503 responses, (2) requests larger than 10,000 bytes coming from China, (3) downloads of .zip archives except from Windows.

5. 5. Save and share

   Why? A saved search becomes a dashboard component.

   Save the search for 503 responses under the name “503 errors” with the columns host, request and clientip.

Difficulty level : ●●○○○ (2/5)