ELK: Elasticsearch, Logstash and Kibana for Administrators...

Introduction

• Elastic Stack Overview (ELK)

Elasticsearch

Overview:

• What and Why
• Terminology: Documents, Index, Shards, Node, Cluster, Scale Up/Out

Operate: Configuring & Deploying

• Configuring Elasticsearch
• Deploying Elasticsearch
• Lab

Node: Discovery, Types, and Cluster State

• Distributed Model and Discovery
• Master, Data, Client, and Tribe Nodes
• Master Election and Minimum Master Nodes
• Cluster State
• Shard Allocation

Backup: Snapshot and Restore

• High Availability vs. Backup
• Repository, Snapshot, and Restore
• Internals

Production Monitoring

• Alerting Best Practices
• JVM
• Query Performance
• Thread Pools
• Diagnosing Problems

Production Operational Best Practices

• Memory
• Networking
• Disk
• Security
• Cluster Restart (Rolling and Full)

Logstash

• What and Why
• Configuration
• Inputs, Filters, and Outputs
• Installation and configuration
• Backup and restore
• Cluster and availability nuances
• Best practices

Kibana

• What and Why
• Configuration Settings
• Time Picker, Search, and Filters
• Kibana Discover, Visualization, and Dashboard Interfaces
• Installation and configuration
• Backup and restore
• Cluster and availability nuances
• Best practices

Filebeat

• Logs and problems
• Filebeat architecture
• Installation and configuration
• Backup and restore
• Cluster and availability nuances
• Best practices

Summary and Conclusion