Log centralization
Aggregate logs from multiple servers to a single central point.
Observability · Courses
Logstash: from discovery to expertise
Discover everything you need to know about deploying, configuring, and administering a Logstash cluster. Master the creation of pipelines to process your data with various input, filter, and output plugins.
At your pace, through practice.By the end of this course you will be able to
- Build a Logstash input → filter → output pipeline
- Parse and enrich logs with dissect, grok and mutate
- Make ingestion reliable with persistent queues and DLQ
- Monitor Logstash with its monitoring API
LEARNING PATH
Course curriculum
0Course overview1 lesson
1Introduction3 lessons
2Pipeline: inputs1 lesson
3Pipeline: filters3 lessons
4Pipeline: output1 lesson
5Going further7 lessons
- Plugin managementLesson · ⏱ 4 min
- Elastic Common Schema (ECS)Lesson · ⏱ 9 min
- Setting up the test environmentHands-on lab · ⏱ 21 min · Level 1/5
- Logstash installationHands-on lab · ⏱ 21 min · Level 1/5
- My first pipelineHands-on lab · ⏱ 42 min · Level 2/5
- My second pipelineHands-on lab · ⏱ 35 min · Level 3/5
- Logstash best practicesArticle · ⏱ 8 min
LEARN BY DOING
Use cases & applications
Data enrichment
Add information like IP address geolocation via GeoIP.
Anonymization
Mask or remove sensitive data (PII) before indexing.
Recommended prerequisites
What next?
Frequently asked questions
What is Logstash?
An open source data collection engine to process and enrich events.
What is a pipeline?
A series of data processing steps including inputs, filters, and outputs.
Why use the Grok filter?
To parse and structure unstructured text into identifiable fields.
What is the difference between Beats and Logstash?
Beats is lightweight and collects data at the source, while Logstash is a heavy engine that centralizes and transforms the data.