# Best practice for adding user profile information to event stream

**URL:** <https://discuss.elastic.co/t/best-practice-for-adding-user-profile-information-to-event-stream/105689>\
**Category:** Logstash\
**Created:** [October 29, 2017, 11:37pm UTC](https://discuss.elastic.co/t/best-practice-for-adding-user-profile-information-to-event-stream/105689 "2017-10-29T23:37:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![danielmcquillen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmcquillen/32/23536_2.png) [@danielmcquillen](https://discuss.elastic.co/u/danielmcquillen)\
**Post date:** [October 29, 2017, 11:37pm UTC](https://discuss.elastic.co/t/best-practice-for-adding-user-profile-information-to-event-stream/105689/1 "2017-10-29T23:37:33Z")

</div>

Is there a best practice in logstash for adding extra user information to incoming realtime log events?

I'm wondering what the best way is to lookup, for example, MySQL user profile data by the incoming user\_id and add profile information to incoming event.

Or is that kind of operation better done in some kind of periodic reindexing operation? (The analytics don't have to be real-time.)

Either way, the event is stored in ES with extra user profile info so we can, say, group by certain user characteristics when analyzing data, etc.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 30, 2017, 12:24am UTC](https://discuss.elastic.co/t/best-practice-for-adding-user-profile-information-to-event-stream/105689/2 "2017-10-30T00:24:58Z")

</div>

You can use a SQL store, you could also store that user info in Elasticsearch and then use the Elasticsearch filter to add it in your Logstash pipeline.

That'd be cheaper than reindexing to add it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2017, 12:25am UTC](https://discuss.elastic.co/t/best-practice-for-adding-user-profile-information-to-event-stream/105689/3 "2017-11-27T00:25:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.