# Get current active users in the application using Elastic/Kibana Visualization

**URL:** <https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030>\
**Category:** Kibana\
**Created:** [January 24, 2021, 11:37am UTC](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030 "2021-01-24T11:37:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![SAKA\_RAM\_DEWASI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saka_ram_dewasi/32/77606_2.png) [@SAKA\_RAM\_DEWASI](https://discuss.elastic.co/u/SAKA_RAM_DEWASI)\
**Post date:** [January 24, 2021, 11:37am UTC](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030/1 "2021-01-24T11:37:51Z")

</div>

Hi all,

I am new to elastic and kibana. I want to get current active users in web application using audit logs stored in elastic index. We capture login and logout event of user in audit log and stored as document in elastic index.

Below is the sample document:

_ **For logout event:** _

Jan 23, 2021 @ 17:35:44.893  
id: c384f67e-de6a-4161-bcbe-ca434bb62453  
entityType:idmauditlogentity  
userId:8ac8953561c2db8c0161dbef14c21519  
**principal:M31XX**  
managedSysId:-  
timestamp:Jan 23, 2021 @ 17:35:44.893  
source:[https://myhostname.com/service/menu/MYINFO](https://myhostname.com/service/menu/MYINFO)  
clientIP:100.34.100.25  
nodeIP:myhostname  
**action:LOGOUT**  
**result:SUCCESS**  
hash:d5f0d34add6dyedil04e5a38ddmange546bcb630a5470more83bb25db2c317c698a

_ **For login event:** _  
id:07b5ebc6-82ba-4113-a93d-09b6b47278d0  
entityType:idmauditlogentity  
userId:8ac8953561c2db8c0161dbef14c21519  
**principal:M31XXX**  
managedSysId:0  
timestamp:Jan 23, 2021 @ 17:35:26.465  
source:-  
clientIP:100.34.100.25  
nodeIP:myhostname  
**action:LOGIN**  
**result:SUCCESS**  
hash:facdf7e925670c8f491192ca055c105a47042e122f2b327712c809b0f2d94257

Now here field _principal_ is user name, action is action performed by user and result is either success or failure.

Here logic is that we need to check last action (LOGIN/LOGOUT/others) performed by user . If last(latest) performed action is not equal to LOGOUT , then consider user as an active user.

Query:

1. Get the count of users whose name(principal field is user name in elastic index) start with either CC\*|MM\*|VC\* and their latest(last) action is not equal to LOGOUT.

Help will be greatly appreciate.

Thanks.

---

<div class="post-metadata">

**Author:** ![SAKA\_RAM\_DEWASI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saka_ram_dewasi/32/77606_2.png) [@SAKA\_RAM\_DEWASI](https://discuss.elastic.co/u/SAKA_RAM_DEWASI)\
**Post date:** [January 25, 2021, 8:06am UTC](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030/2 "2021-01-25T08:06:10Z")

</div>

Hey Geeks,

Anyone there to guide me on my query!!!

---

<div class="post-metadata">

**Author:** ![SAKA\_RAM\_DEWASI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saka_ram_dewasi/32/77606_2.png) [@SAKA\_RAM\_DEWASI](https://discuss.elastic.co/u/SAKA_RAM_DEWASI)\
**Post date:** [January 27, 2021, 4:53am UTC](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030/3 "2021-01-27T04:53:54Z")

</div>

Hi All,

Can anyone give some tips/hints/guidance on my above query?

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [January 29, 2021, 3:27pm UTC](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030/4 "2021-01-29T15:27:03Z")

</div>

Hello @SAKA_RAM_DEWASI

Which version of the elastic stack are you using? Which license?

What app are you logging?

Elasticsearch doesn't really provide a method for comparing documents in the manner you're attempting to. The solution is to have one document per session, creating the document when a session is started and updating the document when the session is closed. There might be log ingest tools that would help with this.

Thanks,  
Matt

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2021, 3:27pm UTC](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030/5 "2021-02-26T15:27:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.