The grok filter doesn't count anything, it only extracts text to fields. You can use the mutate filter's split option to turn a string of space-separated usernames into an array. I don't think there's a stock filter for counting the number of elements in an array, but the ruby filter is always an option (that filter could of course also do the splitting).
That looks good. My thought was to have Kibana do the counting by setting up a visualization metric with "Aggregation" set to "Count". There might be a better way to do this, but I'm thinking that %{GREEDYDATA:users} needs to be split up so that Kibana can do the counting.
Do you have any suggestions on how to make that happen?
I don't think aggregations can count the number of elements in an array field. If you want to use that kind of aggregation you'd have to split each event into one event per user, which might be possible with the split filter. But maybe you don't have to use a count aggregation; if you save the number of users into a field (as above) you could use a sum aggregation. Depending on what the data represents that may or may not be what you're looking for.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.