DevOps Training Icon
Data Analyst Training Icon

ELK Stack Boot Camp - Elasticsearch, Logstash, and Kibana

3 Days Classroom Session   |  
3 Days Live Online
Classroom Registration
Group Rate:
(per registrant, 2 or more)
GSA Individual:
Live Online Registration
Live Online:
Private Onsite Package

This course can be tailored to your needs for private, onsite delivery at your location.

Request a Private Onsite Price Quote

Professional Credits


ASPE is an IIBA Endorsed Education Provider of business analysis training. Select Project Delivery courses offer IIBA continuing development units (CDU) in accordance with IIBA standards.


Select courses offer Leadership (PDU-L), Strategic (PDU-S) and Technical PMI professional development units that vary according to certification. Technical PDUs are available in the following types: ACP, PBA, PfMP, PMP/PgMP, RMP, and SP.


In today’s world, we have so much data that it’s hard to find what we want. We need a tool that can help us find the needle in that Big Data haystack. The Elastic Stack, more commonly known as the ELK Stack, is a collection of tools to help you search all that data and find what you need.

The ELK Stack has become the most popular tool for ingesting data that you can later search and visualize. From log analysis to security monitoring, there are many use-cases for ELK.

This Elasticsearch training course is intended for engineers and architects who want to make sense of their machine data and learn how to ingest, search, analyze and visualize it all using the ELK Stack. You will start by learning how to install and configure all of the ELK Stack components—Elasticsearch, Logstash, Kibana, Beats, and X-Pack. Next, you will learn how to collect the data you need with Logstash and Beats and send into Elasticsearch, the search and analytics engine. By the end of this course, you will learn how to visualize all of this data in Kibana. You will also learn to use X-Pack to notify yourself and your team when problems are found that you can investigate and fix them.

In this Elasticsearch Training, You Will Learn How to:

  • Get started with Elastic Stack components
  • Perform useful search and analytics queries in Elasticsearch
  • Query and aggregate Elasticsearch indexed data with Query DSL
  • Perform more complex searches using Kibana with data indexed in Elasticsearch
  • Ingest different types of machine data in both Logstash and Beats
  • Work with search results to create powerful visualizations with Kibana
  • Secure and monitor your Elastic Stack
  • Extend your Elastic Stack deployment to a production environment
Upcoming Dates and Locations
All Live Online times are listed in Eastern Time Guaranteed To Run
Request a quote for private onsite training Request
May 19, 2020 – May 21, 2020    10:30am – 6:30pm Live Online Register
May 20, 2020 – May 22, 2020    8:30am – 4:30pm Baltimore, Maryland

Hilton Garden Inn BWI Airport
1516 Aero Drive
Linthicum Heights, MD 21090
United States

Jun 24, 2020 – Jun 26, 2020    8:30am – 4:30pm Live Online Register
Jun 24, 2020 – Jun 26, 2020    8:30am – 4:30pm Boston, Massachusetts

Attune, formerly Microtek Boston
25 Burlington Mall Road
2nd Floor
Burlington, MA 01803
United States

Jul 22, 2020 – Jul 24, 2020    8:30am – 4:30pm Portland, Oregon

Kinetic Technology Solutions
15495 SW Sequoia Parkway
Suite 100
Portland, OR 97224
United States

Jul 22, 2020 – Jul 24, 2020    11:30am – 7:30pm Live Online Register
Aug 19, 2020 – Aug 21, 2020    8:30am – 4:30pm San Francisco, California

Learn IT
33 New Montgomery St.
Suite 300
San Francisco, CA 94105
United States

Aug 19, 2020 – Aug 21, 2020    11:30am – 7:30pm Live Online Register
Sep 23, 2020 – Sep 25, 2020    8:30am – 4:30pm Live Online Register
Sep 23, 2020 – Sep 25, 2020    8:30am – 4:30pm Reston, Virginia

Attune, formerly Microtek Reston
12950 Worldgate Drive
Monument II Bldg 4th Flr
Herndon, VA 20170
United States

Oct 21, 2020 – Oct 23, 2020    8:30am – 4:30pm Live Online Register
Oct 21, 2020 – Oct 23, 2020    8:30am – 4:30pm New York, New York

NYC Seminar and Conference Center
71 West 23rd
Suite 515-Lower Level
New York, NY 10010
United States

Nov 18, 2020 – Nov 20, 2020    8:30am – 4:30pm Minneapolis, Minnesota

Embassy Suites Airport
7901 34th Avenue South
Bloomington, MN 55425
United States

Nov 18, 2020 – Nov 20, 2020    9:30am – 5:30pm Live Online Register
Dec 16, 2020 – Dec 18, 2020    8:30am – 4:30pm Live Online Register
Dec 16, 2020 – Dec 18, 2020    8:30am – 4:30pm Raleigh, North Carolina

ASPE, a Cprime Company
2000 Regency Parkway
Suite 335
Cary, NC 27518
United States

Course Outline

Part 1: Getting started with Elastic Stack

  1. What is the ELK Stack?
  2. Elastic Stack architecture
  3. Licensing and costs
  4. ELK on-prem
  5. ELK cloud service
  6. Common deployment scenarios
  7. Deployment tools examples: Docker and Kubernetes
  8. A case study from Netflix

Part 2: Getting started with Elasticsearch

  1. Introduction to Elasticsearch
  2. Understanding logical Elasticsearch concepts
    • Documents
    • JSON data structure
    • Mappings
    • Indices
  3. Understanding an inverted index
  4. Understanding the connection between Elasticsearch and Apache Lucene
  5. Understanding the difference between Elasticsearch and an RDBMS
  6. Retrieving data from indices and documents
    • Using RESTful API
    • Using client APIs: Java, .NET, Ruby, and Python
    • Using graphing and analytics tools: Kibana and Grafana
  7. Understanding Elasticsearch architecture for scalability
    • Deploying clusters
    • Deploying nodes in clusters
    • How sharding works
    • How replication works
  8. Exercise: install and configure Elasticsearch to create a cluster and node
  9. Getting data into Elasticsearch
    • Creating an index
    • Adding documents to an index
    • Indexing many documents
  10. Getting data out of Elasticsearch
  11. Using HTTP methods (GET, POST, PUT, UPDATE, DELETE) with curl
  12. Exercise: create an index and add documents to Elasticsearch with curl
  13. Exercise: retrieve data from Elasticsearch via your browser and curl
  14. Basic searches and queries UI tools
  15. Exercise: install and run Kibana
  16. Exercise: run basic queries using Kibana Console (Dev Tools)

Part 3: Querying Elasticsearch

  1. What is Query Domain Specific Language (DSL)?
  2. DSL query context
  3. DSL filter context
  4. Writing and submitting search queries
    • Search using Boolean operators
    • Search for field terms
    • Search within ranges
    • Search with wildcards and regular expressions
  5. Exercise: write and submit queries using Kibana Discover

Part 4: Aggregations in Query DSL

  1. What are aggregations?
  2. Different types of aggregations
  3. Performing bucket and metric aggregations
  4. Exercise: create metric or bucket aggregations

Part 5: Define how Elasticsearch stores and indexes data with mapping

  1. What is mapping?
  2. Understand mapping types
  3. Field data types and meta-fields
  4. Dynamic mapping
  5. Exercise: add mapping to an index

Part 6: Extending Elasticsearch functionality with plugins and integrations

Part 7: Fundamentals of Logstash

  1. Introduction to Logstash
  2. Logstash features overview
  3. Installing Logstash
  4. Exercise: install and configure Logstash
  5. Process simple Logstash event
  6. Exercise: implement a simple Logstash pipeline
  7. Advanced Logstash pipeline
  8. Exercise: build Logstash pipeline (with logs or network streams)
  9. Working with Logstash plugins
    • Input plugins
    • Output plugins
    • Filter plugins
    • Codec plugins
  10. Exercise: writing a Logstash config with input and output plugins
  11. Exercise: search for Logstash data in Kibana
  12. Troubleshooting Logstash performance

Part 8: Shipping data with Beats

  1. Introduction to Beats
  2. What are the Beats?
    • Filebeat
    • Packetbeat
    • Metricbeat
    • Heartbeat
    • Auditbeat
    • Winlogbeat
    • Community Beats
  3. Installing and configuring Beats
  4. Commonly used Beats: Filebeat and Metricbeat
  5. Configure Filebeat to use Elasticsearch
  6. Exercise: install and configure Filebeat to send logs to Elasticsearch
  7. Beats vs. Logstash
  8. Exercise: configure Filebeat to send logs to Logstash; see the difference in Kibana
  9. Configure Metricbeat to use Logstash
  10. Exercise: install and configure Metricbeat for system monitoring via Logstash

Part 9: Visualizing data with Kibana

  1. Additional information about Kibana
  2. Walkthrough of Kibana UI
  3. Introducing Kibana Query Language (KQL)
  4. KQL vs. Lucene query syntax
  5. Saving and reusing searches
  6. Exploring Kibana visualizations
  7. Visualization types
  8. Exercise: create different types of visualizations
  9. Introduction to Kibana dashboards
  10. Exercise: create your own dashboards

Part 10: Extending ELK deployment to production with X-Pack

  1. What is X-Pack?
  2. Security
    • Authentication and authorization
    • Third-party integration
    • Exercise: configure security monitoring
  3. Monitoring Elastic Stack
  4. Alerting
    • Creating alerts
    • Scheduling alerts
    • Alert notifications
    • Exercise: create an alert
  5. Reporting
    • Exporting Kibana visualization and data
    • Creating on-demand reports
    • Creating scheduled reports
    • Exercise: create on-demand and scheduled reports
  6. Machine learning
    • Anomaly detection
    • Capacity planning and forecasting

Part 11: Putting it all together

  1. Exercise: create and save new searches to visualize in Kibana and add to a new dashboard
  2. Summary of everything learned
Who should attend

This Elasticsearch training course is intended for engineers and architects who want to make sense of their machine data and learn how to ingest, search, analyze and visualize it all using the ELK Stack. Some professions that may find this course particularly useful include:

  • Software Developers and Engineers
  • Data Architects
  • System Administrators
  • DevOps Practitioners
  • Data/Security Analysts
  • Monitoring and Observability Teams

Download the brochure