Private corporate batches, live online cohorts and 1-on-1 mentoring in the whole Elastic Stack — Beats and Logstash ingest, Elasticsearch storage, Kibana analysis, and the observability and security solutions on top — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches the Elastic Stack as one pipeline rather than four products: a Beat's module and field output, the Logstash filters or ingest processors that reshape it, the index template and mapping it lands in, the lifecycle policy that ages it out, and the Kibana query that finally reads it — traced end to end against a running cluster so attendees can see where a field is lost. Sessions cover the design decisions that are expensive to reverse — Elastic Common Schema field naming, data streams and index strategy, shard sizing against a stated retention window, and where to transform data — as well as the operational half: TLS and role-based access, snapshot and restore, tiering, upgrade order across the stack, and diagnosing an ingest path that has silently stopped.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Elastic Stack that means a trainer who has run it in production — the whole Elastic Stack — Beats and Logstash ingest, Elasticsearch storage, Kibana analysis, and the observability and security solutions on top — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Elastic Stack batchThe Elastic Stack is a set of components that together take data from wherever it is produced to a place where a human can ask questions of it. Beats ship it, Logstash and ingest pipelines transform it, Elasticsearch indexes and stores it, and Kibana queries and visualises it. The stack is still widely called ELK, from the original Elasticsearch–Logstash–Kibana trio, but Beats made the shipper tier a first-class part of the design and the acronym never caught up.
Each tier answers a different question. Beats are small single-purpose agents — Filebeat for logs, Metricbeat for metrics, Winlogbeat for Windows events, Packetbeat for network flows, Auditbeat for audit and file-integrity data, Heartbeat for availability — and their module system ships pre-built parsing, dashboards and index templates for common sources. Logstash is the heavyweight transformation tier, used when parsing, enrichment, routing or buffering exceed what an ingest pipeline should do. Elasticsearch is the distributed index: shards, mappings, the Query DSL and aggregations. Kibana is the query and presentation surface: Discover, KQL, Lens, dashboards, alerting and the solution apps.
What makes the Elastic Stack a single subject rather than four products is that its decisions cascade. The field names a Beat emits determine the mapping Elasticsearch creates, the mapping determines which Kibana visualisations are possible, and the index and lifecycle strategy determines whether any of it still works at month six. The Elastic Common Schema exists precisely to make those decisions once, across every source, so that a query written for one data set works against another.
Almost every organisation now runs a centralised log platform, and a large share of them run this one. Logs, metrics, traces, audit records and security telemetry converge on the same storage and query layer, which makes the Elastic Stack shared infrastructure — and shared infrastructure is where an ownership gap becomes expensive.
The demand is characteristically for people who can see the whole pipeline. Application teams file tickets about a missing field; platform teams see a cluster with too many shards; security teams see detection rules that stopped firing. All three are usually the same underlying problem: an ingest decision made in a Beat or a Logstash filter that nobody traced through to the mapping. An engineer who can follow a single event from the agent that emitted it to the dashboard that renders it is unusually useful and unusually rare.
Cost is the second driver. Log volume grows faster than budgets, and the levers that control it — what you ship, what you parse, what you index versus store, index lifecycle management, tiering and retention — all sit inside the stack. Teams that never learned those levers pay for them in hardware.
The architecture first, so every later decision has somewhere to sit. What each component does, why the shipper tier exists separately from the transformation tier, how the pieces version together, and where the Elastic Stack is the right platform against Splunk, Grafana Loki, OpenSearch or a managed cloud logging service.
Topics: Overview of the Elastic Stack and its components · Elasticsearch, Logstash, Kibana and Beats: who does what · Why ELK became the Elastic Stack · Use cases: logging, observability, security, application search, analytics · Comparison with Splunk, Loki, Graylog and cloud-native logging · Elastic Cloud, self-managed and Elastic Cloud on Kubernetes · Licensing tiers and what is in the free Basic tier · Elasticsearch and OpenSearch: what actually diverged · Version compatibility and upgrade order across the stack
Enough Elasticsearch to run the stack well: how documents are indexed, what a shard is, why a mapping is close to irreversible, and how to query. This is the working-level treatment aimed at stack operators — the dedicated Elasticsearch track goes further into relevance, analysis chains and cluster internals.
Topics: Setting up the environment and installing Elasticsearch · Cluster, node, index, document, shard and replica · Configuring the cluster: node roles, discovery and heap sizing · Creating and managing indices, and index aliases · Indexing, updating and deleting documents through the REST API · Mappings: dynamic vs explicit, text vs keyword, and why it matters downstream · Searching with the Query DSL: match, term, range and bool · Query context vs filter context · Aggregations for grouping and computation · Monitoring cluster health and using the cat APIs
The agents that put data into the stack. Installing and configuring each Beat, the module system that ships parsing, index templates and dashboards together, processors that filter and enrich at the edge, and the output and back-pressure behaviour that decides what happens when the cluster is slow.
Topics: Installing Beats shippers and the shared configuration model · Filebeat for forwarding and centralising logs and files · Metricbeat for system and service metrics · Winlogbeat for centralising Windows event logs · Packetbeat for analysing network flows, DNS and protocols · Auditbeat for audit records and file integrity monitoring · Heartbeat for uptime and availability checks · Enabling modules and their configuration options · Beat processors: drop, rename, add_fields, dissect · Outputs: Elasticsearch, Logstash, Kafka — and when to choose each · Registry files, back-pressure and at-least-once delivery · Deploying Beats on Kubernetes as DaemonSets, and Elastic Agent
Where parsing and enrichment beyond a Beat's reach happens. Pipeline anatomy, the input plugins that matter, grok and the other parsing filters, enrichment with geoip and useragent, conditionals and routing, then the practical question the module exists to answer: ingest pipeline, Beat processor or Logstash?
Topics: Overview of Logstash: inputs, filters, outputs · Installing Logstash and the pipeline configuration model · Configuring inputs: beats, file, syslog, http, jdbc, kafka · Grok parsing, custom patterns and the dissect alternative · Filters: mutate, date, json, csv, kv, split · Enrichment: geoip, useragent, translate and lookups · Conditionals and routing between outputs · Multiple pipelines and pipeline-to-pipeline communication · The Elasticsearch output, data streams and index naming · Persistent queues, the dead letter queue and durability · Elasticsearch ingest pipelines and the _simulate API · Choosing between Beat processor, ingest pipeline and Logstash
The surface everyone else in the organisation actually sees. Data views, Discover and KQL for investigation, Lens and the visualisation types for presentation, dashboards with filters and drilldowns, and the organisational features — spaces, saved objects, permissions — that keep a shared Kibana usable rather than a graveyard of abandoned charts.
Topics: Installing and configuring Kibana · Data views, index patterns and runtime fields · Discover, KQL and Lucene query syntax · Building visualisations with Lens · Bar, line, pie, table, gauge, metric and map visualisations · TSVB and time-series analysis · Building and managing dashboards, filters and drilldowns · Canvas and reporting · Spaces, saved objects and import/export between environments · Dev Tools console as the fastest path to the API · Dashboard performance and query cost
The decisions that determine whether the stack still works at scale. The Elastic Common Schema and why consistent field naming across sources is the highest-value work in the whole platform. Index templates and component templates, data streams and rollover, shard sizing against a real retention window, and index lifecycle management across the hot, warm, cold and frozen tiers.
Topics: The Elastic Common Schema and normalised field naming · Index templates, component templates and their precedence · Data streams, backing indices and rollover · Time-based index naming and when it still applies · Shard sizing for a stated volume and retention window · Index lifecycle management: hot, warm, cold, frozen, delete · Searchable snapshots and the cost tiers · Mapping explosions and how ingest causes them · Reindexing without downtime behind an alias · Retention, deletion and compliance requirements · Estimating storage and node count from an ingest rate
The most common reason organisations adopt this stack, built completely. Application, system, container and network logs from source to dashboard, with structured logging conventions, multiline and stack trace handling, correlation identifiers, and the debugging discipline for an ingest path that has silently stopped delivering.
Topics: Structured logging conventions applications should follow · Multiline events and parsing stack traces · Container and Kubernetes log collection and metadata enrichment · Syslog, network device and appliance ingestion · Correlation IDs and following a request across services · Handling high-cardinality fields · Sampling, filtering and dropping noise at the edge · Diagnosing a broken pipeline: which tier lost the event · Ingest monitoring and lag detection · Log volume reduction and cost control
The stack beyond logs. Metricbeat and the Elastic Agent for infrastructure and service metrics, uptime monitoring with Heartbeat and synthetics, APM for application traces and transactions, and the alerting framework that turns any of it into a page — with rules, connectors and actions.
Topics: Metrics collection with Metricbeat modules and Elastic Agent · Infrastructure and hosts views in Kibana · Uptime, synthetics and availability checks · APM: agents, services, transactions, spans and dependencies · Tracing, service maps and error tracking · OpenTelemetry ingestion into the stack · Alerting rules, conditions and throttling · Connectors and actions: email, Slack, webhook, PagerDuty · Anomaly detection and machine learning jobs · Correlating logs, metrics and traces for one incident
The Elastic Stack as a SIEM. What a SIEM has to do, the security data sources the Beats and integrations already cover, the security app's timelines, hosts and network views, detection rules and alert triage, and the hunting workflow that turns raw event data into an answered question.
Topics: SIEM concepts and components · Security data sources: system, auditd, file integrity, Windows events · Network sources: flows, DNS, Zeek, Suricata, firewall and proxy integrations · Normalising security data onto ECS · The security app: timelines, hosts, network and raw event views · Detection rules, exceptions and rule tuning · Alert triage, severity and case management · Threat hunting with Kibana: enrichment and pivoting · Anomaly detection applied to security data · Endpoint telemetry, triage and response · Retention and evidence requirements for security data
Running it as production infrastructure. TLS between every tier, authentication and role-based access control, spaces and field-level restrictions, then the operational work: snapshots to object storage, upgrades in the correct order across four components, capacity planning, monitoring the monitoring stack, and the incidents that recur.
Topics: TLS between Beats, Logstash, Elasticsearch and Kibana · Authentication realms: native, LDAP, SAML and API keys · Role-based access control, spaces and document/field-level security · Securing Kibana and audit logging · Snapshot repositories, policies and restore testing · Upgrade order and version compatibility across the stack · Rolling upgrades and rollback planning · Stack monitoring and what to alert on · Capacity planning and node sizing · Common production incidents and their signatures · Deploying on Kubernetes with Elastic Cloud on Kubernetes · Cost control: tiering, retention and ingest reduction
We rebuild the agenda around the tools you actually run.
Request a custom agendaFollow a single log line from the Filebeat that reads it, through a Logstash filter, into a mapped index, to the Kibana visualisation that renders it — then break each tier in turn and locate the loss.
Take a messy multiline application log with stack traces and produce clean ECS-named typed fields, using grok, dissect and multiline handling.
Normalise three differently-named data sources onto the Elastic Common Schema so that a single KQL query and a single dashboard work across all of them.
Design data streams and an ILM policy for a stated ingest rate and retention rule, force a rollover, and prove the storage projection with real numbers.
Ingest audit and network telemetry, normalise it, write a detection rule, generate the activity that triggers it, and tune out the false positives.
Deliver an end-to-end platform — Beats, Logstash, a secured multi-node cluster and Kibana — with TLS, RBAC, ILM, snapshots, dashboards and working alerts.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
Very detailed explanation and has lots of patience in attending the questionnaire. Thanks again for your wonderful sessions.
Good discussion, helped us to understand different tools in SRE.
Got good lab sessions which kept the new DevOps tool learnings to the point and it helped a lot in my career.
I took Terraform training with the tutor named Mithilesh. I requested to tailor the course curriculum for my needs. He did an excellent job of showing me how to write the Terraform script per the instructions provided.
My experience with the AIOps training was positive. The course covered important topics in a structured way, and Rajesh Kumar explained the concepts patiently. I found the practical aspects particularly helpful because they made the technical content easier to understand.
I was looking to improve my understanding of AIOps, and this training helped me achieve that goal. Rajesh Kumar explained the subject in a structured and practical manner. The sessions on different AIOps concepts were informative.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.