Slice logs based on start and end of an user session

Elastic Stack Elasticsearch
1

Hi,
I have multiple sets of user session start and end events. I would like to slice the logs within session start and end time frame. Then group them as events occurred within user session. I don't have any ID to uniquely identify a session. All I have is just logs for session start and end. Is there a way to accomplish this in elastic search?

Sample Logs:
date: 2016-10-25T02:12:22.234Z, message: "Session Started", UserID: 42342342
date: 2016-10-25T02:12:24.234Z, message: "User clicked the page My Account", UserID: 42342342
date: 2016-10-25T02:12:27.234Z, message: "User added item", UserID: 42342342
date: 2016-10-25T02:12:30.234Z message: Session ended "My Account", UserID: 42342342

In the above sample, I would like to slice and bucket the middle two logs for different sessions.

Thank you,
Satheesh

2

Hi @satheeshravir,

you want to look for "entity centric indexing". This talk from Mark should get you started: https://www.elastic.co/videos/entity-centric-indexing-mark-harwood

Daniel

3

Thank you. I have checked that before. I wanted to see whether there is any other way of solving the problem.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.