Elastic Search - Extract data from message to use as grouping

[jbartlett]

Hi,

My application outputs a log every time a user logs into the system in the pattern [username] LOGIN_SUCCESSFUL, e.g.

john.doe LOGIN_SUCCESSFUL
jane.doe LOGIN_SUCCESSFUL

I am capturing these logs (and all the others) in ElasticSearch and then I’m trying to use Grafana to build a dashboard that shows the number of successful logins per user per day.

I’ve managed to create a dashboard (table panel) which shows overall successful logins per day (e.g. query on LOGIN_SUCCESSFUL) however I cannot see any way of extracting the user section of the log and then using that within the dashboard grouping.

Does anyone know if there is a way to do this?

[davewaters]

That should be fairly easy. Here is an example. Instead of username, I am grouping by ‘Source_Hostname’. The result for my table will be a Column of ‘Source_Hostname’, and another Column of ‘Count’. Note that the Query field is specific to my dashboard, you can set that appropriately to your needs.