On-Site Elastic Stack Engineer for High-Volume Ingestion

ZP Group; Colorado; On-site; USD 120,000 - 180,000; Full time

Job summary

Zachary Piper Solutions is seeking an Elastic Engineer to support a mission‑critical federal program at Schriever Space Force Base (SFB). This on‑site role focuses on designing, implementing, and maintaining large‑scale log ingestion architectures using the Elastic Stack.

The ideal candidate will have deep expertise in Logstash pipeline engineering, ECS normalization, and high‑volume ingestion across restricted and air‑gapped environments, with hands-on experience in Grok, Dissect, KV, JSON

Qualifications

• 3+ years hands-on Elastic Stack experience.
• Advanced Logstash pipeline engineering.
• Strong knowledge of Elastic Common Schema (ECS).
• Linux administration experience.

Responsibilities

• Design and deploy ingestion pipelines for endpoint security telemetry, network devices, cloud security logs, Linux audit logs, Windows Event Logs, Kubernetes/OpenShift logs, and custom application logs.
• Normalize incoming data into ECS compliant formats.
• Implement parsing using Grok, Dissect, KV, JSON decoding, and Translate filters.
• Design and manage multi-pipeline Logstash architectures, including pipeline-to-pipeline routing and output isolator patterns.
• Tune Logstash JVM performance and troubleshoot ingestion bottlenecks.
• Deploy and manage Elastic Agents using Fleet Server and centralized policy management.
• Support air-gapped artifact and package repositories.
• Implement ingestion resiliency, redundancy, and failover strategies.
• Validate ingestion correctness, ECS alignment, and lifecycle management compliance.
• Support high-availability production environments, including restricted and disconnected networks.

Skills

Elastic Stack

Logstash pipeline engineering

Elastic Common Schema (ECS)

Linux administration

High-volume ingestion troubleshooting

Tools

Grok

Dissect

KV filter

JSON decoding

Translate filter

Fleet Server

Elastic Agents

Job description

Zachary Piper Solutions is seeking an Elastic Engineer to support a mission‑critical federal program at Schriever Space Force Base (SFB). This on‑site role focuses on designing, implementing, and maintaining large‑scale log ingestion architectures using the Elastic Stack.

The ideal candidate will have deep expertise in Logstash pipeline engineering, ECS normalization, and high‑volume ingestion across restricted and air‑gapped environments, with hands-on experience in Grok, Dissect, KV, JSON