Logstash Developer Engineer – L2

Role Summary

Key Responsibilities

• Develop, enhance, test, and deploy Logstash pipelines and Grok patterns for security, network, cloud, application, database, and OS log sources.
• Independently troubleshoot Not Grokked events, parsing failures, log drops, delays, incorrect tagging, and pipeline-routing issues.
• Parse and normalize logs into Elastic Common Schema (ECS) or defined SIEM schemas.
• Work with Grok, Dissect, JSON, KV, Mutate, Date, Ruby and other Logstash filters.
• Validate raw-to-parsed event flow and ensure all intended fields are correctly extracted and mapped.
• Handle multiline, nested JSON, variable-format and high-volume log sources.
• Troubleshoot end-to-end ingestion across Syslog/Filebeat/Elastic Agent → Logstash → Kafka/Redis → Elasticsearch/SIEM environments.
• Perform Grok regression and validation before production deployment to ensure no field loss or parsing rework.
• Optimize Logstash configurations for throughput, CPU/memory utilization, queue management and pipeline stability.
• Diagnose Elasticsearch indexing/mapping errors related to ingestion pipelines.
• Work with REST APIs and API-based collectors; working knowledge of Python for log collection/transformation is preferred.
• Perform RCA for recurring parsing/ingestion issues and maintain SOPs, KEDB, validation checklists and lessons learned.
• Provide L2 support, technical guidance and KT to L1/Integration engineers, reducing dependency on individual developers.
• Coordinate with SOC, Integration, Product and Engineering teams for complex issues and production deployments.

Required Technical Skills

Expected L2 Competency

Key Success Measures

• Grok/parser accuracy and ECS compliance
• Reduction in Not Grokked/parsing backlog
• Minimal post-deployment defects and rework
• No unintended log loss or ingestion delay
• Faster parser development and issue-resolution turnaround
• Pipeline stability and performance
• Quality of RCA, KEDB and technical documentation