ELK to resolve IIS username to show fullname of the user

Elastic Stack Logstash
1

Currently I have a setup Filebeats >> Logstash >> Elastic Search >> Kibana.

I am using this to parse the IIS access logs. In access logs we get the username. But my requirement is to show the full name of the user.

Is there a way I can connect my Logstash or Kibana to LDAP or Active directory server and get the full names instead of username displayed on kibana.

2

Take a look at this thread, which is solving a slightly different problem. It suggests exporting AD data and then using either a translate filter or an elasticsearch lookup into the exported data.

3

@Badger Sure, Will take a look. Thanks.