# Getting user id from logstash
**URL:** https://discuss.elastic.co/t/getting-user-id-from-logstash/339504
**Category:** Logstash
**Created:** [July 28, 2023, 6:55am UTC](https://discuss.elastic.co/t/getting-user-id-from-logstash/339504 "2023-07-28T06:55:32Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@frh](https://discuss.elastic.co/u/frh)
#### Post date: [July 28, 2023, 6:55am UTC](https://discuss.elastic.co/t/getting-user-id-from-logstash/339504/1 "2023-07-28T06:55:32Z")
Hi,
I've been trying to get this output in kibana by modifying my logstash, but to no avail. I'm not sure what went wrong.
Input: User 'xxxxxx' logged in with concurrent ALM
My logstash looks something like this: match =\> {"therest" =\> "^(?:User %{QUOTEDSTRING:test} logged in with concurrent ALM)$"}
"therest" is a custom field that values are taken from.
I've been modifying here and there but the field of "test" didn't come up in Kibana.
---
### Author:  [@frh](https://discuss.elastic.co/u/frh)
#### Post date: [July 31, 2023, 10:01am UTC](https://discuss.elastic.co/t/getting-user-id-from-logstash/339504/2 "2023-07-31T10:01:29Z")
This topic can be closed. I was able to figure it out using below:
`User \'%{DATA:userid}\' logged in with concurrent ALM`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 28, 2023, 10:02am UTC](https://discuss.elastic.co/t/getting-user-id-from-logstash/339504/3 "2023-08-28T10:02:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.