Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
Open-Source Search and Analytics Sovereignty
- Elastic license changes and subsequent forks.
- Comparing feature parity between OpenSearch and Elasticsearch in 2025-2026.
- Key use cases: enterprise search, log analytics, SIEM, and observability.
Cluster Architecture
- Node roles: master, data, coordinating, and ingest nodes.
- Security plugin configuration: TLS for internode communication, certificates, and PKI.
- Preventing split-brain scenarios using discovery.seed_hosts and minimum master node settings.
Data Ingestion
- Indexing via REST API, bulk loading, and mapping definitions.
- Pipelines using Beats, Fluent Bit, and Logstash.
- Collecting traces and metrics with the OpenTelemetry Collector.
Search and Dashboards
- Query DSL components: match, term, range, aggregations, and nested fields.
- Creating visualizations and dashboards in OpenSearch Dashboards.
- SIEM applications: alert rules and anomaly detection.
Index Management
- ILM strategies: rollover, shrinking, and deletion.
- Implementing hot-warm-cold architectures.
- Optimizing mappings and text analysis.
Security and Access Control
- RBAC implementation involving users, roles, and tenants.
- Authentication via SAML and OpenID Connect.
- Document-level security and field masking techniques.
Backup and Recovery
- Configuring snapshot repositories on MinIO, S3, or NFS.
- Automating snapshots using Curator or ISM.
- Restoring specific indices and executing cluster-wide disaster recovery.
Requirements
- A solid understanding of search engines and inverted indexes.
- Practical experience with REST APIs and JSON data formats.
- Fundamental Linux administration skills, including systemd, log management, and package handling.
Target Audience
- Engineers specializing in search and log analytics.
- Teams looking to migrate away from managed Elasticsearch or Splunk.
- Security analysts developing sovereign SIEM backends.
14 Hours
Testimonials (1)
the trainer was very good and made the training perfect for my needs
