# Count impressions with Winlogbeat **URL:** \ **Category:** Elasticsearch\ **Created:** [July 8, 2021, 7:30am UTC](https://discuss.elastic.co/t/count-impressions-with-winlogbeat/278146 "2021-07-08T07:30:09Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![rdrit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rdrit/32/91325_2.png) [@rdrit](https://discuss.elastic.co/u/rdrit)\ **Post date:** [July 8, 2021, 7:30am UTC](https://discuss.elastic.co/t/count-impressions-with-winlogbeat/278146/1 "2021-07-08T07:30:09Z")
Hello everyone, I am coming to you because I am facing a problem. I am using ELK and Winlogbeat, I have enabled print service logging on a server and I want to do a Dashboard to track impressions. After some research all the information is available to make this dashboard. I need to make a sum to have the printing total which is reported in winlog.user\_data.Param8. This is when the problems start, the field is of type keyword and it is therefore impossible for me to do calculations on it. I tried several things at the level of the index to pass it in length but without result. Do you have a lead so that I can use this field to do some calculations with? The ideal would be to add a field when sending the style log: If event.action = printing of a document and event.code = 307: add in the Pages\_printer field (which would be of type long) = winlog.user\_data.Param8 Thank you in advance for your help. Roman ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 5, 2021, 7:31am UTC](https://discuss.elastic.co/t/count-impressions-with-winlogbeat/278146/2 "2021-08-05T07:31:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.