# Search for all files owned by a particular user

**URL:** <https://discuss.elastic.co/t/search-for-all-files-owned-by-a-particular-user/117854>\
**Category:** Elasticsearch\
**Created:** [January 31, 2018, 4:39pm UTC](https://discuss.elastic.co/t/search-for-all-files-owned-by-a-particular-user/117854 "2018-01-31T16:39:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abe\_Bazouie](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@Abe\_Bazouie](https://discuss.elastic.co/u/Abe_Bazouie)\
**Post date:** [January 31, 2018, 4:39pm UTC](https://discuss.elastic.co/t/search-for-all-files-owned-by-a-particular-user/117854/1 "2018-01-31T16:39:05Z")

</div>

Hi guys,

I am new to ES so I am not too sure how accurate is my question. I have a SAN with many terabytes of data. All users have their own home directory or share directory on that. I am looking for a solution to, when someone left them company, I can easily find all the files belong to him and report that to his manager in order to reassign to somebody else. Right now I am doing that by find command like:  
find / -user $USERNAME \> /root/userfiles.txt  
But it is so time and resource consuming.  
I am thinking to a solution to index all files' metadata (like: owner) and store them into a database and when I need I just search through that list by writing a query.  
I think might be ES can help me in this way, so my question is, ES is a good solution for my problem at all or if not do you have any suggestion?

Thanks,

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 31, 2018, 5:00pm UTC](https://discuss.elastic.co/t/search-for-all-files-owned-by-a-particular-user/117854/2 "2018-01-31T17:00:13Z")

</div>

I did something close to that I guess. Read [http://david.pilato.fr/blog/2015/12/10/building-a-directory-map-with-elk/](http://david.pilato.fr/blog/2015/12/10/building-a-directory-map-with-elk/)

Might help you.

Also FSCrawler has kind of support for that: [https://github.com/dadoonet/fscrawler#adding-file-attributes](https://github.com/dadoonet/fscrawler#adding-file-attributes)

---

<div class="post-metadata">

**Author:** ![Abe\_Bazouie](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@Abe\_Bazouie](https://discuss.elastic.co/u/Abe_Bazouie)\
**Post date:** [February 1, 2018, 2:47pm UTC](https://discuss.elastic.co/t/search-for-all-files-owned-by-a-particular-user/117854/3 "2018-02-01T14:47:43Z")

</div>

Thanks David for quick reply!  
Are you sure FSCrawler can pull our some information like: files' owner, UID and etc. ?  
During my research for a suitable solution, I found this one. any idea? [https://github.com/shirosaidev/diskover](https://github.com/shirosaidev/diskover)

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 1, 2018, 3:05pm UTC](https://discuss.elastic.co/t/search-for-all-files-owned-by-a-particular-user/117854/4 "2018-02-01T15:05:40Z")

</div>

It is supposed to extract some basic information.

But there is still some work to do:

> <https://github.com/dadoonet/fscrawler/issues/464>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2018, 3:05pm UTC](https://discuss.elastic.co/t/search-for-all-files-owned-by-a-particular-user/117854/5 "2018-03-01T15:05:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.