# Separating the logs **URL:** \ **Category:** Kibana\ **Created:** [March 23, 2017, 9:50am UTC](https://discuss.elastic.co/t/separating-the-logs/79720 "2017-03-23T09:50:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 23, 2017, 9:50am UTC](https://discuss.elastic.co/t/separating-the-logs/79720/1 "2017-03-23T09:50:47Z")
Hello All, Could you please someone help me to achieve this task. My requirement is to separate the logs like website wise. I have many websites configured in my system. Most of the website logs are storing in a file so i am able to display the logs in kibana but as soon as open kibana everyone able to view all [logs.To](http://logs.To) avoid that By using x-pack i created the users but dont know how to restrict the user wise access to website logs. **Ex:** Now A user can only see [abc.com](http://abc.com) logs and B user can see [xyz.com](http://xyz.com) site logs but not other sites. How can i make this type of restriction in ELK? Regards Raja ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 23, 2017, 9:51am UTC](https://discuss.elastic.co/t/separating-the-logs/79720/2 "2017-03-23T09:51:58Z")
Is there some kind of identification tag in each log so you can filter? ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 23, 2017, 10:01am UTC](https://discuss.elastic.co/t/separating-the-logs/79720/3 "2017-03-23T10:01:44Z")
Hi Mark, Yes, identification tag is there. The logs are showing site name like [abc.com](http://abc.com), [xyz.com](http://xyz.com) in their own site logs. Regards Raja ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 23, 2017, 10:05am UTC](https://discuss.elastic.co/t/separating-the-logs/79720/4 "2017-03-23T10:05:02Z")
Hi Mark, I just reviewed the logs and found common identification names like few of them below Service application\_name resource Above all names are there for all sites. Regards Raja ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 23, 2017, 7:58pm UTC](https://discuss.elastic.co/t/separating-the-logs/79720/5 "2017-03-23T19:58:44Z")
This is going to be your next step - [https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html](https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html) ---
**Author:** ![Raja1](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Post date:** [March 27, 2017, 4:27am UTC](https://discuss.elastic.co/t/separating-the-logs/79720/6 "2017-03-27T04:27:09Z")
Hi Mark, Thanks for your reply. I have gone thru the link but i am confusing where the indices has to be written and also how to define site based restriction. If you dont mind could you please provide some example config so that i will try to use and make accordingly. Regards Raja ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 24, 2017, 4:27am UTC](https://discuss.elastic.co/t/separating-the-logs/79720/7 "2017-04-24T04:27:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.