# Is it possible to collect the file owner (username) for a log file?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-collect-the-file-owner-username-for-a-log-file/138358>\
**Category:** Beats\
**Created:** [July 3, 2018, 10:49am UTC](https://discuss.elastic.co/t/is-it-possible-to-collect-the-file-owner-username-for-a-log-file/138358 "2018-07-03T10:49:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dan\_Shechter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dan_shechter/32/32910_2.png) [@Dan\_Shechter](https://discuss.elastic.co/u/Dan_Shechter)\
**Post date:** [July 3, 2018, 10:49am UTC](https://discuss.elastic.co/t/is-it-possible-to-collect-the-file-owner-username-for-a-log-file/138358/1 "2018-07-03T10:49:17Z")

</div>

We are using filebeat to collect hadoop / yarn userlogs when running yarn applications.

Currently, our hadoop/yarn setup uses hadoop's authentication mechanisms, and therefore, the userlogs (normally under /var/log/yarn/userlogs/\*\*) we collect from hadoop are owned by individual authenticated users.

Is it possible or would be possible to allow filebeat to collect the username (and perhaps optionally, the group name) that of the user/group of the file owner?

If/when this would be collected, we could then easily filter for individual users when exploring our logs via elasticsearch / kibana....

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [July 3, 2018, 2:16pm UTC](https://discuss.elastic.co/t/is-it-possible-to-collect-the-file-owner-username-for-a-log-file/138358/2 "2018-07-03T14:16:03Z")

</div>

This is currently not possible. I remember seeing similar requests in the past but couldn't find it Github, only this one here: [https://github.com/elastic/beats/issues/4169](https://github.com/elastic/beats/issues/4169) The reason I think it's similar as it also requests to add metadata about the file to each event. We could potentially solve this with a `add_file_metata` processor.

Do you want to open a Github issue with this idea?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 31, 2018, 4:16pm UTC](https://discuss.elastic.co/t/is-it-possible-to-collect-the-file-owner-username-for-a-log-file/138358/3 "2018-07-31T16:16:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.