# Ingesting openLDAP logs

**URL:** <https://discuss.elastic.co/t/ingesting-openldap-logs/148638>\
**Category:** Logstash\
**Created:** [September 14, 2018, 2:55pm UTC](https://discuss.elastic.co/t/ingesting-openldap-logs/148638 "2018-09-14T14:55:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DunkB](https://avatars.discourse-cdn.com/v4/letter/d/9de053/32.png) [@DunkB](https://discuss.elastic.co/u/DunkB)\
**Post date:** [September 14, 2018, 2:55pm UTC](https://discuss.elastic.co/t/ingesting-openldap-logs/148638/1 "2018-09-14T14:55:32Z")

</div>

Hi All,  
Is anyone ingesting openldap logs in a way that makes it easy to analyse what was done by a certain client, find all the clients failing TLS handshakes or binding as a certain user for example.

client transactions are linked by servername, connectionID pairs but ingesting logs via logstash means  
each transaction goes into it's own document and searching is a matter of looking for an IP or bind DN or TLS handshake result, then searching for each returned connectionID individually to see the full set of transaction logs for that client / connection.

Thanks,  
Duncan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2018, 2:55pm UTC](https://discuss.elastic.co/t/ingesting-openldap-logs/148638/2 "2018-10-12T14:55:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.