# Correlate Across Events without Re-indexing/Enriching each Event **URL:** \ **Category:** Kibana\ **Created:** [June 26, 2019, 6:04pm UTC](https://discuss.elastic.co/t/correlate-across-events-without-re-indexing-enriching-each-event/187645 "2019-06-26T18:04:42Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![justinkase](https://avatars.discourse-cdn.com/v4/letter/j/51bf81/32.png) [@justinkase](https://discuss.elastic.co/u/justinkase)\ **Post date:** [June 26, 2019, 6:04pm UTC](https://discuss.elastic.co/t/correlate-across-events-without-re-indexing-enriching-each-event/187645/1 "2019-06-26T18:04:43Z")
Hi Kibana Experts! I have a bunch of different log files that have the action (SRCH, RESULT, BIND) and user\_name (Mike) in separate events from the events containing the server IP addresses they connect to. These different events are tied together by by the conn ID (example events below). My question is - how can write a search that maps the user (Mike) to the servers they are attaching to (98.76.54.321), without re-indexing/enriching the original log file? [01/May/2015:20:39:01 -0400] conn=2693446 op=1 msgId=2 - SRCH base="ou=people,o=acme acme" scope=2 filter="(&(uid= **Mike** )(cn=\*))" attrs="cn" [01/May/2015:20:39:01 -0400] conn=2693446 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0.000000 dn="cn=AcmeAuth,ou=ldapids,o=acme acme" [01/May/2015:20:39:01 -0400] conn=2693446 op=-1 msgId=-1 - fd=266 slot=266 LDAP connection from 43.345.3.234:34952 to **98.76.54.321** Thanks!!! Justin ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 24, 2019, 6:04pm UTC](https://discuss.elastic.co/t/correlate-across-events-without-re-indexing-enriching-each-event/187645/2 "2019-07-24T18:04:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.