# Can elsastic search a logfile and pull users from that file

**URL:** <https://discuss.elastic.co/t/can-elsastic-search-a-logfile-and-pull-users-from-that-file/47407>\
**Category:** Elasticsearch\
**Created:** [April 14, 2016, 3:07pm UTC](https://discuss.elastic.co/t/can-elsastic-search-a-logfile-and-pull-users-from-that-file/47407 "2016-04-14T15:07:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nickdot](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@nickdot](https://discuss.elastic.co/u/nickdot)\
**Post date:** [April 14, 2016, 3:07pm UTC](https://discuss.elastic.co/t/can-elsastic-search-a-logfile-and-pull-users-from-that-file/47407/1 "2016-04-14T15:07:43Z")

</div>

Hello,

I'm new to Elastic/Logstash/kibana. I was wondering if I could actually do a search of a log file and pull out particular information and then output it to kibana graphically or within a table.

Here is the message that I'm trying to parse:

"logmessage": "Accepted a login request from a client. Client = xxx.xxx.xxx.xx:xxxxx, Username = xxxxx"

I'm actually trying to display any time someone logs in but I just need the "Username = xxxx", portion.

Is that possible?

I'm trying to think if I can do this with grok, but I cant find any examples.

---

<div class="post-metadata">

**Author:** ![nickdot](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@nickdot](https://discuss.elastic.co/u/nickdot)\
**Post date:** [April 14, 2016, 4:26pm UTC](https://discuss.elastic.co/t/can-elsastic-search-a-logfile-and-pull-users-from-that-file/47407/2 "2016-04-14T16:26:45Z")

</div>

Here is my example to work of what I came up with:

if "Accepted a login request from a client" in [logmessage] {  
grok {  
match =\> ["logmessage", "Username = "]  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:59pm UTC](https://discuss.elastic.co/t/can-elsastic-search-a-logfile-and-pull-users-from-that-file/47407/3 "2017-07-05T22:59:08Z")

</div>