RousselTMLEARNING
EN
FrançaisEnglishEspañol
Sign in

Observabilité · Courses

Logstash: from discovery to expertise

Discover everything you need to know about deploying, configuring, and administering a Logstash cluster. Master the creation of pipelines to process your data with various input, filter, and output plugins.

6 chapters16 lessonsEN
At your pace, through practice.

By the end of this course you will be able to

  • Build a Logstash input → filter → output pipeline
  • Parse and enrich logs with dissect, grok and mutate
  • Make ingestion reliable with persistent queues and DLQ
  • Monitor Logstash with its monitoring API

🎯 Level : Intermediate👥 Who it is for : Operators and data engineers centralising logs and events

LEARNING PATH

Course curriculum

0Course overview1 lesson
  1. Assessment quizQuiz · ⏱ 10 min
1Introduction3 lessons
  1. IntroductionLesson
  2. The pipeline conceptLesson
  3. InstallationLesson
2Pipeline: inputs1 lesson
  1. The inputs: inputsLesson
3Pipeline: filters3 lessons
  1. The filters: filtersLesson
  2. The filters: grok pluginLesson
  3. The filters: dissect vs grok pluginLesson
4Pipeline: output1 lesson
  1. The outputs: outputLesson
5Going further7 lessons
  1. Plugin managementLesson
  2. Elastic Common Schema (ECS)Lesson
  3. Setting up the test environmentHands-on lab · ⏱ 21 min · Level 1/5
  4. Logstash installationHands-on lab · ⏱ 21 min · Level 1/5
  5. My first pipelineHands-on lab · ⏱ 42 min · Level 2/5
  6. My second pipelineHands-on lab · ⏱ 35 min · Level 3/5
  7. Logstash best practicesArticle · ⏱ 8 min

LEARN BY DOING

Use cases & applications

Log centralization

Aggregate logs from multiple servers to a single central point.

Data enrichment

Add information like IP address geolocation via GeoIP.

Anonymization

Mask or remove sensitive data (PII) before indexing.

Recommended prerequisites

Elasticsearch : de la découverte à l'expertise

What next?

Beats: From Discovery to ExpertiseDynatrace: From Discovery to ExpertisePrometheus: From Discovery to Expertise

Frequently asked questions

What is Logstash?

An open source data collection engine to process and enrich events.

What is a pipeline?

A series of data processing steps including inputs, filters, and outputs.

Why use the Grok filter?

To parse and structure unstructured text into identifiable fields.

What is the difference between Beats and Logstash?

Beats is lightweight and collects data at the source, while Logstash is a heavy engine that centralizes and transforms the data.