# Compare Kibana data with a static list?

**URL:** <https://discuss.elastic.co/t/compare-kibana-data-with-a-static-list/41191>\
**Category:** Kibana\
**Created:** [February 8, 2016, 2:57pm UTC](https://discuss.elastic.co/t/compare-kibana-data-with-a-static-list/41191 "2016-02-08T14:57:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gildor7](https://avatars.discourse-cdn.com/v4/letter/g/cc9497/32.png) [@gildor7](https://discuss.elastic.co/u/gildor7)\
**Post date:** [February 8, 2016, 2:57pm UTC](https://discuss.elastic.co/t/compare-kibana-data-with-a-static-list/41191/1 "2016-02-08T14:57:45Z")

</div>

Hello, is it possible to compare data displayed in Kibana with a static list?  
Let me explain what I need: I'm reading the data of login to the servers via syslog, and I want to create a dashboard that shows me the logins of users not found in a list of authorized users.

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [February 8, 2016, 7:25pm UTC](https://discuss.elastic.co/t/compare-kibana-data-with-a-static-list/41191/2 "2016-02-08T19:25:22Z")

</div>

Nope, the best way to do this would be at index time. Use logstash to update each event with `authoried: true/false` and then you can easily visualize it with Kibana.

---

<div class="post-metadata">

**Author:** ![gildor7](https://avatars.discourse-cdn.com/v4/letter/g/cc9497/32.png) [@gildor7](https://discuss.elastic.co/u/gildor7)\
**Post date:** [February 9, 2016, 9:07am UTC](https://discuss.elastic.co/t/compare-kibana-data-with-a-static-list/41191/3 "2016-02-09T09:07:50Z")

</div>

Interesting option. Is there a way in logstash to compare a field with a text file as a csv?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 9, 2016, 9:08am UTC](https://discuss.elastic.co/t/compare-kibana-data-with-a-static-list/41191/4 "2016-02-09T09:08:21Z")

</div>

Look at the translate filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:02pm UTC](https://discuss.elastic.co/t/compare-kibana-data-with-a-static-list/41191/5 "2017-07-06T14:02:49Z")

</div>