Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 14 hours
Course Outline
Day 1: Foundations, Architecture, and Detailed Differences (ELK vs. OpenSearch)
Morning Session: Core Concepts & Architecture Review
- Introduction & History:
- Exploring the origins of the ELK Stack (Elasticsearch, Logstash, Kibana)
- The 2021 fork: Contextualising why OpenSearch emerged (shifting licensing dynamics between AWS and Elastic, Apache 2.0 vs. SSPL/Elastic License) - Under the Hood (The Shared DNA):
- The Apache Lucene core engine: examining shards, segments, inverted indices, and document storage
- Distributed cluster architecture: defining Nodes (Master, Data, Coordinator), clusters, and cluster state management
- Fundamentals of Data Ingestion and Processing:
- Logstash pipelines, Beats, and contemporary alternatives (Fluentbit, OpenTelemetry/Data Prepper)
Afternoon Session: Feature Divergence & Ecosystem Variations
- Security & Enterprise Feature Comparison:
- Elasticsearch: Evaluating free-tier security constraints against paid features (SSO, advanced alerting, machine learning, and cross-cluster replication tiers)
- OpenSearch: Assessing out-of-the-box free fine-grained access control, internal user database, SAML/LDAP integration, and security plugins - UI & Query Languages:
- Kibana vs. OpenSearch Dashboards: Comparing interface layouts, management tools, and developer experience
- Query Languages: Contrasting Elasticsearch's ES|QL with OpenSearch's PPL (Piped Processing Language) and SQL support - Advanced Workloads (Vector Search & AI):
- Analysing HNSW implementations, k-NN search performance, and approaches to machine learning integration.
Day 2: Installation, Migration Strategies, Operations, and Troubleshooting
Morning Session: Installation & Cluster Setup
- Deploying OpenSearch:
- Reviewing system requirements, kernel parameters (vm.max_map_count), and JVM heap tuning
- Executing bare-metal/VM installation via tarball and package managers
- Implementing containerised deployment using Docker and Docker Compose
- Bootstrapping multi-node clusters and initialising the security plugin (opensearch-security-install) - Configuring OpenSearch Dashboards:
- Establishing connections between Dashboards and the OpenSearch cluster
- Setting up SSL/TLS certificates and authentication backends
Afternoon Session: Migration Path, Operations & Best Practices
- Migration Strategies (ELK to OpenSearch):
- Assessing current ES version compatibility (identifying optimal paths from pre-7.10/7.11 versus newer versions)
- Snapshot & Restore Method: Leveraging shared repository storage (AWS S3, NFS) for seamless data transfer
- Reindex-from-Remote & Logstash Rolling Migrations: Managing live data cutovers with minimal downtime
- Adjusting API and client SDKs (updating endpoints, connection strings, and client libraries) - Lifecycle Management & Operational Differences:
- Comparing Elasticsearch ILM (Index Lifecycle Management) with OpenSearch ISM (Index State Management) in terms of syntax and policies
- Exploring rollover, shrinking, downsampling, and index retention strategies - Monitoring, Backup, and Troubleshooting:
- Utilising cluster health APIs, cluster stats, and tracking shard allocation issues
- Addressing common failure scenarios (circuit breaker exceptions, JVM garbage collection pauses, split-brain mitigation)
Q&A and Wrap-up: Open forum for addressing specific organisational migration roadblocks and reviewing architectures
Practical exercises and Hands-On Labs will be a central focus of the course. Participants will develop proficiency in OpenSearch deployment, configuration, data ingestion, security, migration, monitoring, and troubleshooting through realistic, real-world scenarios.
Requirements
Participants are expected to have:
- A solid grasp of basic Linux command-line operations.
- Working knowledge of networking concepts, including TCP/IP, HTTP/HTTPS, and DNS.
- A fundamental understanding of log management and monitoring principles.
- General familiarity with containers (such as Docker) is advantageous, though not strictly mandatory.
- Introductory experience with Elasticsearch or the ELK Stack.
Testimonials (2)
The content is very helpful, and the trainer makes it more easier to understand
Ibrahim Al mayahi - Vastech SA
Course - Advanced Elasticsearch and Kibana Administration
the profesionalism of the trainer; the way he tried to respond to all the questions; the review questions we had to ask: engaging us in conversations
