{"id":2038203,"url":"https://alion.io/job/sisa-logstash-developer-engineer-l2","title":"Logstash Developer Engineer – L2","company":{"id":2144267,"name":"SISA","domain":"sisa.ai","url":"https://alion.io/company/sisa-ai","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Keka","truth_index":{"grade":"B","score":75,"open_postings":9,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-10T05:45:15Z"}},"role":"DevOps","role_family":"DevOps","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon ECS","optional":false},{"name":"Apache Kafka","optional":false},{"name":"ElasticSearch","optional":false},{"name":"Filebeat","optional":false},{"name":"Linux","optional":false},{"name":"Logstash","optional":false},{"name":"Python","optional":false},{"name":"Redis","optional":false},{"name":"Rest API","optional":false},{"name":"Ruby","optional":false},{"name":"SIEM","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true},{"name":"Git","optional":true},{"name":"SQL","optional":true}],"status":"live","first_seen_at":"2026-10-07T15:59:23Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-10-11T16:55:22Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"Logstash Developer Engineer - L2\nRole Summary\nWe are looking for a hands-on Logstash Developer Engineer - L2 responsible for developing, enhancing, troubleshooting, and optimizing Logstash pipelines and Grok parsers for diverse security and infrastructure log sources. The engineer should independently handle complex parsing and ingestion issues while ensuring zero log loss, accurate ECS field mapping, and optimal pipeline performance.\nKey Responsibilities\nDevelop, enhance, test, and deploy Logstash pipelines and Grok patterns for security, network, cloud, application, database, and OS log sources.\nIndependently troubleshoot Not Grokked events, parsing failures, log drops, delays, incorrect tagging, and pipeline-routing issues.\nParse and normalize logs into Elastic Common Schema (ECS) or defined SIEM schemas.\nWork with Grok, Dissect, JSON, KV, Mutate, Date, Ruby and other Logstash filters.\nValidate raw-to-parsed event flow and ensure all intended fields are correctly extracted and mapped.\nHandle multiline, nested JSON, variable-format and high-volume log sources.\nTroubleshoot end-to-end ingestion across Syslog/Filebeat/Elastic Agent → Logstash → Kafka/Redis → Elasticsearch/SIEM environments.\nPerform Grok regression and validation before production deployment to ensure no field loss or parsing rework.\nOptimize Logstash configurations for throughput, CPU/memory utilization, queue management and pipeline stability.\nDiagnose Elasticsearch indexing/mapping errors related to ingestion pipelines.\nWork with REST APIs and API-based collectors; working knowledge of Python for log collection/transformation is preferred.\nPerform RCA for recurring parsing/ingestion issues and maintain SOPs, KEDB, validation checklists and lessons learned.\nProvide L2 support, technical guidance and KT to L1/Integration engineers, reducing dependency on individual developers.\nCoordinate with SOC, Integration, Product and Engineering teams for complex issues and production deployments.\nRequired Technical Skills\nMust Have: Logstash, Grok/Dissect, Regex, Elasticsearch, ECS mapping, Linux, Syslog, JSON, REST APIs, troubleshooting and performance optimization.\nGood to Have: Kafka, Redis, Filebeat/Elastic Agent, Python, Git, SQL, cloud log sources (AWS/Azure/GCP), SIEM platforms and cybersecurity log-source knowledge.\nExpected L2 Competency\nThe candidate should be capable of independently owning a log source from raw-log analysis through Grok development, validation, deployment and production stabilization. L2 engineers should troubleshoot complex ingestion problems, perform RCA, optimize existing pipelines, mentor junior engineers, and deliver solutions with minimal rework and dependency on senior resources.\nKey Success Measures\nGrok/parser accuracy and ECS compliance\nReduction in Not Grokked/parsing backlog\nMinimal post-deployment defects and rework\nNo unintended log loss or ingestion delay\nFaster parser development and issue-resolution turnaround\nPipeline stability and performance\nQuality of RCA, KEDB and technical documentation","description_format":"text","description_chars":3048,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Artificial Intelligence","Cybersecurity","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-07T16:56:34Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":33,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-10T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/sisa-logstash-developer-engineer-l2","json_url":"https://alion.io/job/sisa-logstash-developer-engineer-l2.json","meta":{"generated_at":"2026-10-11T19:11:49Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5790,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2144267},"rest":"https://alion.io/mcp/rest/get_company?id=2144267"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsisa-logstash-developer-engineer-l2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsisa-logstash-developer-engineer-l2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsisa-logstash-developer-engineer-l2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sisa-logstash-developer-engineer-l2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsisa-logstash-developer-engineer-l2"}]}