# Salesforce Login History into SIEM or Logstash

**URL:** <https://discuss.elastic.co/t/salesforce-login-history-into-siem-or-logstash/258796>\
**Category:** Elastic Security\
**Created:** [December 16, 2020, 2:54am UTC](https://discuss.elastic.co/t/salesforce-login-history-into-siem-or-logstash/258796 "2020-12-16T02:54:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![involuntary-pretzel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/involuntary-pretzel/32/45404_2.png) [@involuntary-pretzel](https://discuss.elastic.co/u/involuntary-pretzel)\
**Post date:** [December 16, 2020, 2:54am UTC](https://discuss.elastic.co/t/salesforce-login-history-into-siem-or-logstash/258796/1 "2020-12-16T02:54:58Z")

</div>

Hi there, I'm trying to get [Salesforce Login History](https://help.salesforce.com/articleView?id=users_login_history.htm&type=5) into the SIEM or at least into Logstash so I can ship it to Elasticsearch.

I notice [Logstash has a Salesforce Plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-salesforce.html), do you know if that has the ability to ship Login History?

Any suggestion on how I would approach this would be great.

---

<div class="post-metadata">

**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\
**Post date:** [December 17, 2020, 6:03am UTC](https://discuss.elastic.co/t/salesforce-login-history-into-siem-or-logstash/258796/2 "2020-12-17T06:03:40Z")

</div>

Hey there @involuntary-pretzel. So I'm not entirely sure if the Saleforce Logstash plugin will be able to bring those in for you, so you may just want to try and see, although it appears to be in maintenance mode at this point so it would be unlikely that support is added. I've reached out to our ingest folks to see if there any way of getting this data in via beats or other means, and will report back. 🙂

Cheers!  
Garrett

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:19am UTC](https://discuss.elastic.co/t/salesforce-login-history-into-siem-or-logstash/258796/3 "2022-11-04T08:19:50Z")

</div>