# Searchs!

**URL:** <https://discuss.elastic.co/t/searchs/135995>\
**Category:** Elasticsearch\
**Created:** [June 14, 2018, 7:28pm UTC](https://discuss.elastic.co/t/searchs/135995 "2018-06-14T19:28:10Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![cgermanb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cgermanb/32/32285_2.png) [@cgermanb](https://discuss.elastic.co/u/cgermanb)\
**Post date:** [June 14, 2018, 7:28pm UTC](https://discuss.elastic.co/t/searchs/135995/1 "2018-06-14T19:28:11Z")

</div>

Hi people, i have a elk working with the logs of a samba file server  
I want make graphics with unlink file but i have a lot of tmp files, i want filter this archives, i read a bit and only find placing "- " but nothing happend, i have the same result.

example of a log:  
domain\admin | 192.168.1.30|hostname|domain|unlink|541b4a62.tmp

I want to show only the files actually deleted by the user

Any idea?

Thanks!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 15, 2018, 4:21am UTC](https://discuss.elastic.co/t/searchs/135995/2 "2018-06-15T04:21:10Z")

</div>

> [@cgermanb](#):
>
> I want to show only the files actually deleted by the user

How do the logs show the deletion?

---

<div class="post-metadata">

**Author:** ![cgermanb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cgermanb/32/32285_2.png) [@cgermanb](https://discuss.elastic.co/u/cgermanb)\
**Post date:** [June 15, 2018, 1:04pm UTC](https://discuss.elastic.co/t/searchs/135995/3 "2018-06-15T13:04:51Z")

</div>

hi warkom,

domain\admin | 192.168.1.30|hostname|domain|unlink|541b4a62.tmp

unlink is how show the deletion and 541b4a62.tmp is the file  
otrher example of write a file would:  
domain\admin | 192.168.1.30|hostname|domain|pwrite|elasticsearch.conf

i can show all of the unlink log, but i need filter the .tmp

i can do it?

king regards,  
Carlos

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 15, 2018, 8:53pm UTC](https://discuss.elastic.co/t/searchs/135995/4 "2018-06-15T20:53:43Z")

</div>

Are you breaking the log line down into parts, eg the user, host, filename etc?

---

<div class="post-metadata">

**Author:** ![cgermanb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cgermanb/32/32285_2.png) [@cgermanb](https://discuss.elastic.co/u/cgermanb)\
**Post date:** [June 15, 2018, 9:01pm UTC](https://discuss.elastic.co/t/searchs/135995/5 "2018-06-15T21:01:20Z")

</div>

Correct, this file server is a samba, in his configuration permit me specific what want appears in the log separete with |

I can do something but i found other files, with this line i can discard tmp files:  
message:unlink !syslog\_message:\*.tmp

but i found others temporary files of word or excel like: original.xls and the tmp file ~$original.xls

now, i need discard ~$original.xls

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 15, 2018, 9:21pm UTC](https://discuss.elastic.co/t/searchs/135995/6 "2018-06-15T21:21:57Z")

</div>

Are you extracting each of the sections of the log file, as separated by `|`, into their own fields via Logstash or something?

---

<div class="post-metadata">

**Author:** ![cgermanb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cgermanb/32/32285_2.png) [@cgermanb](https://discuss.elastic.co/u/cgermanb)\
**Post date:** [June 18, 2018, 2:24pm UTC](https://discuss.elastic.co/t/searchs/135995/7 "2018-06-18T14:24:32Z")

</div>

the records come from the samba file server, it automatically puts them in that format to separate each field

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 18, 2018, 10:06pm UTC](https://discuss.elastic.co/t/searchs/135995/8 "2018-06-18T22:06:30Z")

</div>

OK, but how does the data get into Elasticsearch?

---

<div class="post-metadata">

**Author:** ![cgermanb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cgermanb/32/32285_2.png) [@cgermanb](https://discuss.elastic.co/u/cgermanb)\
**Post date:** [June 19, 2018, 2:39pm UTC](https://discuss.elastic.co/t/searchs/135995/9 "2018-06-19T14:39:37Z")

</div>

Filebeat take the logs

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2018, 2:39pm UTC](https://discuss.elastic.co/t/searchs/135995/10 "2018-07-17T14:39:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.