# GitLab tracking User-Authetications

**URL:** <https://discuss.elastic.co/t/gitlab-tracking-user-authetications/231316>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 6, 2020, 10:10am UTC](https://discuss.elastic.co/t/gitlab-tracking-user-authetications/231316 "2020-05-06T10:10:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![nkellner](https://avatars.discourse-cdn.com/v4/letter/n/b4bc9f/32.png) [@nkellner](https://discuss.elastic.co/u/nkellner)\
**Post date:** [May 6, 2020, 10:10am UTC](https://discuss.elastic.co/t/gitlab-tracking-user-authetications/231316/1 "2020-05-06T10:10:03Z")

</div>

we are using FlieBeat to get teh GitLab-LogFiles.  
In this Logs the User-Action is given.

Do you have any idea how we can handle it in a right way?

What we need is only the state of Userlogins (acepted or denied).

Thanks for a response

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [May 11, 2020, 11:16am UTC](https://discuss.elastic.co/t/gitlab-tracking-user-authetications/231316/2 "2020-05-11T11:16:35Z")

</div>

Hi @nkellner,

I understood that you want to process a GitLab log file with Filebeat. But could you elaborate a bit on what you are hoping to achieve?

---

<div class="post-metadata">

**Author:** ![nkellner](https://avatars.discourse-cdn.com/v4/letter/n/b4bc9f/32.png) [@nkellner](https://discuss.elastic.co/u/nkellner)\
**Post date:** [May 11, 2020, 12:52pm UTC](https://discuss.elastic.co/t/gitlab-tracking-user-authetications/231316/3 "2020-05-11T12:52:37Z")

</div>

Hi,  
thanks for your replay. I´ll try my very best.  
We only need to the "Login" and "Logout" (Authentications) to GitLab. In the Logfile yopu can see an message with "POST" -\> Example message:  
{"method":"POST","path":"/users/auth/ldapmain/callback","format":"html","controller":"OmniauthCallbacksController"," **action":"failure**","status":302,"location":"https://...../users/sign\_in","time":"2020-05-11T12:24:32.893Z","params":[{"key":"utf8","value":"✓"},{"key":"authenticity\_token","value":"[FILTERED]"}, **{"key":"username","value":"****"},{"key":"password","value"**:"

This tell me the Login wasn´t ok.

Can I filter the GitLab-Log in FileSearch for this Information befor I send the Log to ElasticSearch?

For me is the intrest to get the "success" and "failed" Logins.

Sorry, I can exlain it better for the moment, my be I can help you for better understanding.

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [May 11, 2020, 5:42pm UTC](https://discuss.elastic.co/t/gitlab-tracking-user-authetications/231316/4 "2020-05-11T17:42:40Z")

</div>

Ah, so you want to filter out all messages except for those with specific "action" values?

Did you already configure filebeat to parse the JSON messages? If so you could add a [`drop event`](https://www.elastic.co/guide/en/beats/filebeat/current/drop-event.html) processor at the end of the filebeat processor list with a condition such as

```auto
 - drop_event:
     when:
        not:
          or:
            - equals:
                action: "failure"
            - equals:
                action: "success"

```

---

<div class="post-metadata">

**Author:** ![nkellner](https://avatars.discourse-cdn.com/v4/letter/n/b4bc9f/32.png) [@nkellner](https://discuss.elastic.co/u/nkellner)\
**Post date:** [May 13, 2020, 9:17am UTC](https://discuss.elastic.co/t/gitlab-tracking-user-authetications/231316/5 "2020-05-13T09:17:13Z")

</div>

Thank yor for your replay.  
It look like I´m searching for - My first Test works fine.  
Great Stuff

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2020, 9:17am UTC](https://discuss.elastic.co/t/gitlab-tracking-user-authetications/231316/6 "2020-06-10T09:17:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.