What you will learn in this TP
- Collect with Elastic Agent and Fleet
- Structure with Logstash
- Retain with ILM
- Analyse, visualise, alert
- Secure access
Introduction #
What you will learn in this section
- Collect with Elastic Agent and Fleet
- Structure with Logstash
- Retain with ILM
- Analyse, visualise, alert
- Secure access
Context. You apply the whole path to a real case: the assessment grid in the project article states what validates your work.
Prerequisites: the Fleet lab from lab 1 of the Elastic Agent course, jq · Estimated time: 120 min
Hands-on #
Guided steps, with their solution.
1. The lab and system collection
Start the Elastic Agent lab 1 (Elasticsearch, Kibana, Fleet Server, one agent in lab-policy) and check that system logs arrive.
2. 30-day retention
Why? The dedicated index template must exist before the application data stream is created so that it inherits the ILM policy.
3. Logstash for the legacy application
Generate a log file, then run Logstash on the lab network to structure it and send it tologs-legacyapp-lab.4. Analyse and visualise
Write the dashboard ES|QL queries, then build it in Kibana (Lens): status breakdown, errors per minute, top failing URLs, system log volume per host.
5. Alert and secure
Create an ES|QL rule alerting above 5 errors in 5 minutes (as in the Kibana alert lab), then a "reader" role and user limited to reading logs and the dashboard.
Difficulty level : ●●●○○ (3/5)
My progress
Sign in to track your progress and take notes. Sign in
💬 Questions about this lesson
No questions yet: be the first to ask for help or share your configuration.
Recommended Articles
Elastic path project: centralising and using logs
The validation project of the "Elastic Stack mastery" path: Elastic Agent and Fleet, Logstash, El...
Elastic Observability: logs, infrastructure, APM and synthetics
Elastic Observability features: log exploration, infrastructure inventory with Elastic Agent and ...
Agent policies, integrations, data streams and pipelines
Build agent policies, add integrations (System, Nginx, Custom Logs), choose namespaces, customise...
Standalone Elastic Agent, Logstash and Kafka outputs, and OpenTelemetry (EDOT)
Write a standalone configuration, ship to Logstash or Kafka, and use Elastic Agent as an OpenTele...
Elastic Agent: architecture, Fleet and integrations
Understand Elastic Agent: single collection agent, Fleet and Fleet Server, agent policies, integr...
Machine learning in Elastic: anomaly detection and AIOps
Automatically detect abnormal behaviour: anomaly detection jobs, datafeeds, detectors, influencer...
Elastic Security: SIEM, detection rules and investigation
Use Elastic Security as a SIEM: ECS data sources, detection rule types (query, EQL, ES|QL, thresh...
Alerts, connectors and SLOs in Kibana
Create alert rules in Kibana (Elasticsearch query, ES|QL, custom threshold, logs), configure conn...
Kibana: role, installation and first steps
What Kibana is in the Elastic suite, how to install it with Elasticsearch (start-local, Docker), ...