Articles by Andrew Kroh

We’d like to announce the first release candidate of the Elastic Stack 8.0.0 and the continuation of the Pioneer Program. Give it a try and please share all the bugs you find on GitHub.

With the Logstash Lines series, we're keeping you up to date with all that's new in Logstash, from the details of pull requests to learning resources.

With the Brewing in Beats series, we're keeping you up to date with all that's new in Beats, from the details of pull requests to learning resources.

Auditbeat is a new Beat in 6.0. It audits the activities of users and processes. It collects Linux audit logs (similar to auditd) and monitors file integrity.

Using Metricbeat to collect container metrics using Linux cgroups.

How to use the Winlogbeat and Kibana to visualize logon events from Windows event logs.

Using Packetbeat with Elasticsearch and Watcher to detect DNS tunnels.