Guide

These guides explain the concepts behind the collection — how the roles work together, how security and TLS are managed, and how to tune and operate a production cluster.

• Architecture — role interactions, data flow, inventory groups, deployment order
• Security — bootstrapping, built-in users, RBAC, keystore management, audit logging
• TLS & Certificates — PKI model, certificate generation, renewal, custom certificates
• Upgrading — rolling upgrades from 8.x to 9.x, safety checks, rollback
• Performance Tuning — JVM heap, memory locking, thread pools, disk watermarks, Logstash queues
• Best Practices — opinionated recommendations for running ES, Kibana, Logstash, and Beats in production