Elastic Stack (ELK): Logs & Search
Elasticsearch, Logstash, Kibana and Beats. Centralise, index and visualise your logs to analyse and alert in real time.
- Understand the architecture of the Elastic suite
- Ingest and transform logs
- Search and aggregate in Elasticsearch
- Build Kibana dashboards
- Centralise the logs of your whole infrastructure in one place and search them in seconds
- Create a Kibana dashboard that lets your team spot anomalies visually
- Trigger an automatic alert when a critical error pattern appears in your logs
- Move from reactive incident handling (searching after the fact) to a proactive posture
The programme
Day 1 - Elasticsearch
- Indices, documents, static and dynamic mapping
- Query DSL: match, bool, range, term, wildcard
- Aggregations: buckets, metrics, pipelines
- Performance: shards, replicas, index lifecycle management (ILM)
- Workshop: indexing and searching an application log dataset
Day 2 - Ingestion
- Logstash: input → filter → output pipelines, grok and mutate plugins
- Beats: Filebeat (logs), Metricbeat (system metrics), Winlogbeat
- Parsing and enrichment: geoip, user-agent, ingest pipelines
- Workshop: collecting Nginx logs + system metrics into Elasticsearch
Day 3 - Visualisation & alerting
- Kibana: Discover, dashboards, Lens, Maps
- Native Kibana alerting: rules, connectors (Slack, email, webhook)
- ElastAlert2: advanced alerts on patterns, frequencies, spikes
- Observability use cases: SLI/SLO, log-metric correlation
- Workshop: monitoring dashboard + alert on HTTP error rate
Who is this for
Ops, SREs, data engineers and analysts.
Prerequisites
- Linux basics
- Knowledge of logs and JSON
Format
Frequently asked questions
Is the course eligible for OPCO or CPF funding?
No. Sphinx-Digital is not Qualiopi certified and is not listed on Mon Compte Formation. The course is invoiced directly to the company or the individual, with no external funding.
What is the difference between the public (inter-company) and in-company formats?
In the public format, you join a session with participants from other companies (3 to 10 people). In-company, we run a session dedicated to your team, on your site or remotely, with content adapted to your context. In-company pricing is available on quote.
Remote or on-site: what are the practical differences?
Content and labs are identical. Remotely, labs run on cloud environments accessible from a browser, with nothing to install. On-site, you provide the workstations; labs can run in the cloud or locally depending on your infrastructure.
How many participants per session?
3 to 10 participants at most. This deliberate limit ensures everyone can ask questions, adapt the exercises to their context and get a detailed answer.
What is the evening format?
The evening format spreads the same course over 4 sessions of 3.5 hours (14 hours in total), in the evening from 6:30 pm to 10:00 pm. Same content, same labs, same price, so you can build skills without taking days off.
How does payment work?
Courses are invoiced on quote, by bank transfer. Payment in instalments is possible. We issue a training agreement for companies that want their training department to cover the cost.
Interested in this course?
Join the next session or request a tailored in-company session.
What participants say
Not sure this course fits your context?
A 20-minute call to take stock before you enrol, with no sales pitch.