# Find last login for all or selected users

**URL:** <https://discuss.elastic.co/t/find-last-login-for-all-or-selected-users/49642>\
**Category:** Elasticsearch\
**Created:** [May 10, 2016, 11:09am UTC](https://discuss.elastic.co/t/find-last-login-for-all-or-selected-users/49642 "2016-05-10T11:09:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![elucca](https://avatars.discourse-cdn.com/v4/letter/e/e36b37/32.png) [@elucca](https://discuss.elastic.co/u/elucca)\
**Post date:** [May 10, 2016, 11:09am UTC](https://discuss.elastic.co/t/find-last-login-for-all-or-selected-users/49642/1 "2016-05-10T11:09:28Z")

</div>

I would return only the last @timestamp of all users and not just a user

from script return last @timestamp from one user.  
"from" : 0,  
"size" : 1,  
"query" : {  
"bool" : {  
"must" : [ {  
"match" : {  
"user" : {  
"query" : "user@test.com",  
"type" : "phrase"  
}  
}  
}, {  
"match" : {  
"verb" : {  
"query" : "login",  
"type" : "phrase"  
}  
}  
} ]  
}  
},  
"fields" : ["@timestamp", "user"],  
"sort" : [ {  
"@timestamp" : {  
"order" : "desc"  
}  
} ]  
}

---

<div class="post-metadata">

**Author:** ![polyfractal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polyfractal/32/48162_2.png) [@polyfractal](https://discuss.elastic.co/u/polyfractal)\
**Post date:** [May 10, 2016, 3:11pm UTC](https://discuss.elastic.co/t/find-last-login-for-all-or-selected-users/49642/2 "2016-05-10T15:11:44Z")

</div>

I'm not sure I understand the question. Do you want to query for a specific user, but also return the last login for all users at the same time?

Or do you just want to see the last login of all users by itself?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:52pm UTC](https://discuss.elastic.co/t/find-last-login-for-all-or-selected-users/49642/3 "2017-07-05T22:52:43Z")

</div>