# Logontime logofftime

**URL:** <https://discuss.elastic.co/t/logontime-logofftime/268719>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [March 30, 2021, 3:46am UTC](https://discuss.elastic.co/t/logontime-logofftime/268719 "2021-03-30T03:46:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![alipujaistopo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alipujaistopo/32/50791_2.png) [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\
**Post date:** [March 30, 2021, 3:46am UTC](https://discuss.elastic.co/t/logontime-logofftime/268719/1 "2021-03-30T03:46:18Z")

</div>

hello, I'm currently using winlogbeat for window server monitoring. how to i know logon and logoff time an user on windows server?

here's the example of splunk's report

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/9/693a84be35d929a916a0c9e3111b82a77431f7be.png)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 30, 2021, 3:09pm UTC](https://discuss.elastic.co/t/logontime-logofftime/268719/2 "2021-03-30T15:09:01Z")

</div>

The login and logoff times can be determined from two separate events:

> **[4624(S) An account was successfully logged on. (Windows 10) - Windows security](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624)**
>
> Describes security event 4624(S) An account was successfully logged on.

> **[4634(S) An account was logged off. (Windows 10) - Windows security](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634)**
>
> Describes security event 4634(S) An account was logged off. This event is generated when a logon session is terminated and no longer exists.

You can correlate the two events based on the TargetLogonId field. Then compute the difference between the timestamps to get the duration for the session. The [transform](https://www.elastic.co/guide/en/elasticsearch/reference/master/transforms.html) feature is good for this. It can create a new index that contains data similar to that report. Here's a quick example:

```auto
PUT _transform/windows-login-durations
{
  "source": {
    "index": [
      "winlogbeat-*"
    ],
    "query": {
      "bool": {
        "should": [
          {
            "bool": {
              "should": [
                {
                  "match": {
                    "winlog.event_id": "4634"
                  }
                }
              ],
              "minimum_should_match": 1
            }
          },
          {
            "bool": {
              "should": [
                {
                  "match": {
                    "winlog.event_id": "4624"
                  }
                }
              ],
              "minimum_should_match": 1
            }
          }
        ],
        "minimum_should_match": 1
      }
    }
  },
  "pivot": {
    "group_by": {
      "winlog.event_data.TargetLogonId": {
        "terms": {
          "field": "winlog.event_data.TargetLogonId"
        }
      },
     "user.name": {
      "terms": {
        "field": "user.name"
      }
    }
    },
    "aggregations": {
      "@timestamp.min": {
        "min": {
          "field": "@timestamp"
        }
      },
      "@timestamp.max": {
        "max": {
          "field": "@timestamp"
        }
      },
      "duration": { 
        "bucket_script": {
          "buckets_path": {
            "start": "@timestamp.min.value",
            "end": "@timestamp.max.value"
          },
          "script": "params.end - params.start"
        }
      }
    }
  },
  "frequency": "1m",
  "dest": {
    "index": "transform-windows-login-durations"
  },
  "settings": {
    "max_page_search_size": 500
  }
}

```

Then after you start the transform it will create data like this. You can then create a visualization for this data or export it.

```auto
GET transform-windows-login-durations/_search
{
  "took" : 6,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 719,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "transform-windows-login-durations",
        "_id" : "ZTDkJSSfP1etbYyvhphqo5w7AAAAAAAA",
        "_score" : 1.0,
        "_source" : {
          "duration" : 49.0,
          "winlog" : {
            "event_data" : {
              "TargetLogonId" : "0x109266"
            }
          },
          "@timestamp" : {
            "min" : "2020-12-22T17:56:47.573Z",
            "max" : "2020-12-22T17:56:47.622Z"
          },
          "user" : {
            "name" : "elastic"
          }
        }
      },
      {
        "_index" : "transform-windows-login-durations",
        "_id" : "ZTBMl4QYXaD6jMxC0OJF6Ab2AAAAAAAA",
        "_score" : 1.0,
        "_source" : {
          "duration" : 82.0,
          "winlog" : {
            "event_data" : {
              "TargetLogonId" : "0x109c04"
            }
          },
          "@timestamp" : {
            "min" : "2020-12-22T17:56:47.626Z",
            "max" : "2020-12-22T17:56:47.708Z"
          },
          "user" : {
            "name" : "elastic"
          }
        }
      },
...

```

---

<div class="post-metadata">

**Author:** ![alipujaistopo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alipujaistopo/32/50791_2.png) [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\
**Post date:** [March 31, 2021, 2:57am UTC](https://discuss.elastic.co/t/logontime-logofftime/268719/3 "2021-03-31T02:57:11Z")

</div>

where i should create that? in dev tools or json input (create visualize) ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 31, 2021, 2:58am UTC](https://discuss.elastic.co/t/logontime-logofftime/268719/4 "2021-03-31T02:58:29Z")

</div>

Dev tools would be the place.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2021, 4:58am UTC](https://discuss.elastic.co/t/logontime-logofftime/268719/5 "2021-04-28T04:58:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.