# Infoblox - index username to create Dashboard

**URL:** <https://discuss.elastic.co/t/infoblox-index-username-to-create-dashboard/380525>\
**Category:** Kibana\
**Tags:** ilm-index-lifecycle-management\
**Created:** [July 29, 2025, 9:16am UTC](https://discuss.elastic.co/t/infoblox-index-username-to-create-dashboard/380525 "2025-07-29T09:16:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![wabd](https://avatars.discourse-cdn.com/v4/letter/w/97f17d/32.png) [@wabd](https://discuss.elastic.co/u/wabd)\
**Post date:** [July 29, 2025, 9:16am UTC](https://discuss.elastic.co/t/infoblox-index-username-to-create-dashboard/380525/1 "2025-07-29T09:16:09Z")

</div>

Hi,

i am new user of the plateform, my teammate have implemented ELK and Kibana to get log from our appliances.  
I am creating dashboards but i have noticed that username is not indexed yet.

as a consequence, i can't show on the graph how many connections have been made by each user.

i look on some page and suggesting adding an grok processor in order to extract user name like this : "%{TIME:timestamp}\s%{DATA:server}\s%{DATA:process}: %{DATA:log\_message}[%{DATA:username}]:%{GREEDYDATA:additional\_info}"

example of one log which i want to get the field : \<29\>Jul 28 10:26:33 serveur httpd: 2025-07-28 08:26:33.414Z [USERNAME]: Login\_Allowed - - to=AdminConnector ip=X.X.X.X auth=LDAP group=GROUP apparently\_via=API

In the pipelines, there are a lot of grok processors, i add the last one at the bottom but test not okay, filed is not indexed.

Can you help me?

thank you in advance

regards

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [July 29, 2025, 9:58am UTC](https://discuss.elastic.co/t/infoblox-index-username-to-create-dashboard/380525/2 "2025-07-29T09:58:22Z")

</div>

Hello @wabd

Welcome to the community!!

Could you confirm if below is your matching log line ?

`Jul 28 10:26:33 serveur httpd: 2025-07-28 08:26:33.414Z [USERNAME]: Login_Allowed - - to=AdminConnector ip=X.X.X.X auth=LDAP group=GROUP apparently_via=API`

Yes, we can create ingest pipeline & update the default pipeline to extract the USERNAME from the log file.

Have only considered till USERNAME

```auto
PUT _ingest/pipeline/login_event_pipeline
{
  "description": "Parse login event logs",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": [
          "%{MONTH} %{MONTHDAY} %{TIME:syslog_time} %{HOSTNAME:host} %{WORD:service}: %{TIMESTAMP_ISO8601:event_timestamp} \\[%{DATA:username}\\]"
        ]
      }
    },
    {
      "date": {
        "field": "event_timestamp",
        "formats": [
          "yyyy-MM-dd HH:mm:ss.SSSX"
        ]
      }
    }
  ]
}

```

```auto
PUT 29july/_settings
{
  "index": {
    "default_pipeline": "login_event_pipeline"
  }
}

POST 29july/_doc
{
  "message" : "Jul 29 10:26:33 serveur httpd: 2025-07-28 08:26:33.414Z [JOHN]: Login_Allowed - - to=AdminConnector ip=X.X.X.X auth=LDAP group=GROUP apparently_via=API"
}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/9/795b625631b70986d0197676766459d816565c8e.png)

Thanks!!

---

<div class="post-metadata">

**Author:** ![wabd](https://avatars.discourse-cdn.com/v4/letter/w/97f17d/32.png) [@wabd](https://discuss.elastic.co/u/wabd)\
**Post date:** [July 29, 2025, 1:06pm UTC](https://discuss.elastic.co/t/infoblox-index-username-to-create-dashboard/380525/3 "2025-07-29T13:06:35Z")

</div>

Hi Tortoise,

Thank you for your quick support and response.

Regarding your question: I confirm that the required information is indeed present in the `event.original` field, and it matches the format you described when I filter using the keyword **"Login\_Allowed"**.

When I leave the filter blank, here is the format I see:

```auto
@timestamp
Jul 29, 2025 @ 15:01:52.000
@version
1
event.original
<29>Jul 29 13:01:52 server httpd: 2025-07-29 11:01:52.156Z [USER]: Login_Allowed - - to=AdminConnector ip=X.X.X.X auth=LDAP group=GROUP apparently_via=API

```

And after the rest of the syslog message, i don't know if you need all raw log format to do properly this username index job.

Let me know if you need anything else.

Best regards,

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [July 30, 2025, 4:23am UTC](https://discuss.elastic.co/t/infoblox-index-username-to-create-dashboard/380525/4 "2025-07-30T04:23:57Z")

</div>

Hello @wabd

Okay so it seems the log is starting with the syslog\_priority field, please find below updated pipeline & you can review from your end :

```auto
PUT _ingest/pipeline/login_event_pipeline
{
  "description": "Parse login event logs",
  "processors": [
    {
      "grok": {
        "field": "event.original",
        "patterns": [
          "<%{INT:syslog_priority}>%{MONTH} %{MONTHDAY} %{TIME:syslog_time} %{HOSTNAME:host} %{WORD:service}: %{TIMESTAMP_ISO8601:event_timestamp} \\[%{DATA:username}\\]: %{GREEDYDATA:log_details}"
        ]
      }
    },
    {
      "date": {
        "field": "event_timestamp",
        "formats": [
          "yyyy-MM-dd HH:mm:ss.SSSX"
        ]
      }
    }
  ]
}

```

Thanks!!

---

<div class="post-metadata">

**Author:** ![wabd](https://avatars.discourse-cdn.com/v4/letter/w/97f17d/32.png) [@wabd](https://discuss.elastic.co/u/wabd)\
**Post date:** [July 30, 2025, 3:55pm UTC](https://discuss.elastic.co/t/infoblox-index-username-to-create-dashboard/380525/5 "2025-07-30T15:55:53Z")

</div>

Hi Tortoise,

thank you for the answer.

Maybe i add the pattern in the wrong way i got this error for the whole pipeline

```auto
"[
  {
    "set": {
      "field": "event.kind",
      "value": "pipeline_error"
    }
  },
  {
    "append": {
      "field": "error.message",
      "value": "Processor '{{{ _ingest.on_failure_processor_type }}}' {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}' {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'"
    }
  }
]

```

and when i show the index, i see log with previous fields without any issues.

So when i add it i do in the GUI bellow existant groks and i copy the format of the previous one.

`^%{GREEDYDATA:infoblox_nios.log.dns.message}$`

the new one `^%{INT:syslog_priority}>%{MONTH} %{MONTHDAY} %{TIME:syslog_time} %{HOSTNAME:host} %{WORD:service}: %{TIMESTAMP_ISO8601:event_timestamp} \\[%{DATA:username}\\]: %{GREEDYDATA:log_details}$`

each pattern work individually right ?

I also see that we can add manually field in Kibana, but i'm not familiar with the index script required.

Thank you again for your support.

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [July 31, 2025, 4:19am UTC](https://discuss.elastic.co/t/infoblox-index-username-to-create-dashboard/380525/6 "2025-07-31T04:19:57Z")

</div>

Hello @wabd

Instead of editing the existing pipeline maybe follow below steps :

1. Create a new pipeline -new

2. Try to simulate existing record for this pipeline to see if it is working as per your requirement :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e4e1a3a161871faa8a96be8c34f77afc314ecca.png)

1. Once you see that the new pipeline is working as expected than you can update the default pipeline to point to this pipeline post which new records will be indexed with username field.

Thanks!!