Faysal AzizElasticsearch on CentOS
Deploy, manage and troubleshoot Elasticsearch in legacy CentOS environments.
Practise Elasticsearch installation, cluster checks, capacity management and fault diagnosis for network and infrastructure teams supporting event storage and SIEM.
Why this course
Keeping Elasticsearch operational takes more than starting a service. Engineers need to understand how nodes communicate, where events are stored, what cluster health indicators mean, and how resource constraints affect ingestion and search. When problems arise, they need a practical way to distinguish connectivity failures from configuration errors, storage pressure and cluster issues.
This course develops those operational skills through focused theory and guided hands-on work on remote CentOS training servers. Participants install Elasticsearch, configure a small cluster, monitor its behaviour and investigate common faults. The emphasis is on the responsibilities of network and infrastructure engineers supporting event storage and SIEM environments, including deployments used with FortiSIEM.
The training connects Elasticsearch concepts directly to everyday administration: checking services, validating network paths, inspecting logs, managing capacity and recovering from failures. CentOS Linux 7 and 8 are end-of-life systems; legacy installations are studied in controlled training environments, not recommended as new production defaults. Participants distinguish CentOS Linux from CentOS Stream and check the operating system, Elasticsearch and SIEM compatibility requirements for the selected deployment.
The training emphasises practical skills shaped by real operational demands, with guided exercises focused on installation, administration and fault diagnosis.
Learning outcomes
By the end of the course, participants will be able to:
- Explain Elasticsearch nodes, indices, shards and replicas from an operational perspective.
- Prepare a legacy CentOS training environment and select an Elasticsearch release appropriate to the agreed compatibility requirements.
- Configure a small cluster and verify node communication and access controls.
- Monitor cluster health, resource utilisation and event ingestion.
- Diagnose common service, connectivity, storage and shard allocation problems.
- Apply essential performance adjustments, routine maintenance and snapshot recovery procedures.
Prerequisites
- Working experience troubleshooting IP connectivity, DNS, routing and firewall rules.
- Ability to use SSH, navigate Linux directories, edit configuration files and run commands with elevated privileges.
- A laptop or workstation with an SSH-capable client and a web browser.
- Unrestricted internet access.
- Ability to establish SSH connections to remote training servers at public IP addresses, with outbound SSH permitted by the device and network.
6 modules
011. Elasticsearch Fundamentals for Operations4 topics
- Event storage and SIEM architecture
- Master-eligible, data and coordinating node roles
- Indices, primary shards and replicas
- Single-node and cluster deployment principles
022. CentOS Preparation and Elasticsearch Installation5 topics
- Operating system, Elasticsearch and SIEM compatibility
- Legacy CentOS repositories and support lifecycle considerations
- CPU, memory, storage and system resource requirements
- Package installation, configuration files and directory permissions
- Service startup, boot configuration and installation verification
033. Cluster Deployment and Secure Connectivity5 topics
- Cluster identity, node discovery and initial cluster formation
- Hostnames, address binding and node communication
- HTTP and transport ports, firewall rules and access restrictions
- Authentication, TLS certificates and operational permissions
- Cluster membership and connectivity validation
044. Daily Administration and Monitoring5 topics
- Administrative checks using curl and Elasticsearch APIs
- Green, yellow and red cluster health
- Node statistics, index status and shard allocation
- Service status, Elasticsearch logs and system diagnostics
- Event ingestion checks and SIEM-managed retention boundaries
055. Performance, Capacity and Maintenance5 topics
- Event rates, retention periods and storage headroom
- JVM heap, filesystem cache and swap considerations
- Shard and replica sizing fundamentals
- Controlled restarts and post-maintenance verification
- Snapshot creation, restoration and recovery verification
066. Troubleshooting and Service Recovery6 topics
- Startup failures, configuration errors and bootstrap checks
- DNS, firewall, binding and TLS connection failures
- Missing nodes, unassigned shards and unhealthy clusters
- Disk watermarks, storage exhaustion and write blocks
- CPU pressure, JVM memory pressure and rejected requests
- Corrective actions and end-to-end recovery validation
This outline serves as a guideline. The trainer reserves the right to amend the content, sequence, emphasis or delivery approach without prior notice, as reasonably necessary to accommodate participant needs, technical conditions and the course objectives.
A programme built around your team.
Share your training goals and requirements.