Logstash Developer Engineer – L2

Sisainfosec; Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Sisainfosec in Bengaluru, India invites applications for a hands-on Logstash Developer Engineer – L2 to develop, enhance, troubleshoot, and optimize Logstash pipelines and Grok parsers for security and infrastructure logs.

The role requires independent ownership of parsing, zero log loss, accurate ECS field mapping, and high-performance pipelines, with collaboration across SOC, Integration, Product and Engineering teams to deliver robust ingestion solutions.

Qualifications

• Must have hands-on experience building Logstash pipelines and Grok patterns.
• Experience with ECS mapping and log parsing across diverse sources.
• Ability to diagnose parsing failures, log loss, and pipeline routing issues.
• Proficient in managing high-volume log ingestion with reliable throughput.

Responsibilities

• Develop, enhance, test, and deploy Logstash pipelines and Grok patterns for various log sources.
• Independently troubleshoot parsing failures and log drops to ensure data fidelity.
• Parse and normalize logs into ECS or SIEM schemas and validate field extraction.
• Work with Grok, Dissect, JSON, KV, Mutate, Date, Ruby and other Logstash filters.
• Optimize configurations for throughput, resource usage, and pipeline stability.
• Provide L2 support and KT to L1/Integration engineers; coordinate with SOC and engineering teams.

Skills

Logstash

Grok/Dissect

Regex

Elasticsearch

ECS mapping

Linux

Syslog

JSON

REST APIs

Troubleshooting

Performance optimization

Python

Tools

Kafka

Redis

Filebeat/Elastic Agent

Git

SQL

Cloud logs (AWS/Azure/GCP)

Job description

We are looking for a hands-on Logstash Developer Engineer – L2 responsible for developing, enhancing, troubleshooting, and optimizing Logstash pipelines and Grok parsers for diverse security and infrastructure log sources. The engineer should independently handle complex parsing and ingestion issues while ensuring zero log loss, accurate ECS field mapping, and optimal pipeline performance.

Key Responsibilities

• Develop, enhance, test, and deploy Logstash pipelines and Grok patterns for security, network, cloud, application, database, and OS log sources.
• Independently troubleshoot Not Grokked events, parsing failures, log drops, delays, incorrect tagging, and pipeline-routing issues.
• Parse and normalize logs into Elastic Common Schema (ECS) or defined SIEM schemas.
• Work with Grok, Disect, JSON, KV, Mutate, Date, Ruby and other Logstash filters.
• Validate raw-to-parsed event flow and ensure all intended fields are correctly extracted and mapped.
• Handle multiline, nested JSON, variable-format and high-volume log sources.
• Perform Grok regression and validation before production deployment to ensure no field loss or parsing rework.
• Optimize Logstash configurations for throughput, CPU/memory utilization, queue management and pipeline stability.
• Diagnose Elasticsearch indexing/mapping errors related to ingestion pipelines.
• Work with REST APIs and API-based collectors; working knowledge of Python for log collection/transformation is preferred.
• Perform RCA for recurring parsing/ingestion issues and maintain SOPs, KEDB, validation checklists and lessons learned.
• Provide L2 support, technical guidance and KT to L1/Integration engineers, reducing dependency on individual developers.
• Coordinate with SOC, Integration, Product and Engineering teams for complex issues and production deployments.

Required Technical Skills

Must Have: Logstash, Grok/Dissect, Regex, Elasticsearch, ECS mapping, Linux, Syslog, JSON, REST APIs, troubleshooting and performance optimization.

Good to Have: Kafka, Redis, Filebeat/Elastic Agent, Python, Git, SQL, cloud log sources (AWS/Azure/GCP), SIEM platforms and cybersecurity log-source knowledge.

Expected L2 Competency

The candidate should be capable of independently owning a log source from raw-log analysis through Grok development, validation, deployment and production stabilization. L2 engineers should troubleshoot complex ingestion problems, perform RCA, optimize existing pipelines, mentor junior engineers, and deliver solutions with minimal rework and dependency on senior resources.

Key Success Measures

• Grok/parser accuracy and ECS compliance
• Minimal post-deployment defects and rework
• No unintended log loss or ingestion delay
• Faster parser development and issue-resolution turnaround
• Pipeline stability and performance
• Quality of RCA, KEDB and technical documentation