6.2.4

---

Elasticsearch

---

• Why Elasticsearch?
• Install
• Data Type
  • Core data type
    • string : text/keyword
    • numeric : long/integer/short/byte, double/float/half-float
  • Complex data type : array, object, nested
  • Geo data type : geo_point
• API : Indices API, Document API, Search API
• Query DSL : Match All, Full Text, Term Level, Specialized, Compound Queries
• Mapping
• Aggregation : Bucket, Metric, Parent Pipeline, Sibling Pipeline Aggregation

---

Logstash

---

• Install
• Worfklow
• Plugins
  • Input : stdin, file, jdbc, elasticsearch
  • Output : csv, elasticsearch
  • Filter : csv, mutate, grok, date, drop, ruby, elasticsearch
  • (Conditional)

---

Kibana

---

• Install
• Worfklow
• Discover
  • Filtering by Field
  • Lucene Query Syntax
    • Keyword
    • Field Match, Exact Field Match
    • Must be, Must not be present
    • AND, OR, NOT
    • Term
    • Fuzzy, Proximity
    • Numeric Value, Range
    • Wildcard (?, *)
• Visualize
  • Basic Charts : Area, Heat Map, Pie
  • Data : Data Table, Goal, Gauge, Metric
  • Maps : Coordinate Map, Region Map
  • Time Series : Timelion
  • Other : Markdown, Tag Cloud
• Dashboard
• Dev Tools
• Management
  • Index Patterns
  • Field Formatters
    • string field : URL (link, image)
    • date field : date
    • numeric field : duration, bytes, percentage
  • Scripted Fields (Painless)
    • calculation on a single field
    • date manipulation
    • combine string values
    • conditional statement
  • Saved Objects import/export