# Slice logs based on start and end of an user session

**URL:** <https://discuss.elastic.co/t/slice-logs-based-on-start-and-end-of-an-user-session/65856>\
**Category:** Elasticsearch\
**Created:** [November 12, 2016, 12:27am UTC](https://discuss.elastic.co/t/slice-logs-based-on-start-and-end-of-an-user-session/65856 "2016-11-12T00:27:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![satheeshravir](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@satheeshravir](https://discuss.elastic.co/u/satheeshravir)\
**Post date:** [November 12, 2016, 12:27am UTC](https://discuss.elastic.co/t/slice-logs-based-on-start-and-end-of-an-user-session/65856/1 "2016-11-12T00:27:17Z")

</div>

Hi,  
I have multiple sets of user session start and end events. I would like to slice the logs within session start and end time frame. Then group them as events occurred within user session. I don't have any ID to uniquely identify a session. All I have is just logs for session start and end. Is there a way to accomplish this in elastic search?

Sample Logs:  
date: 2016-10-25T02:12:22.234Z, message: "Session Started", UserID: 42342342  
date: 2016-10-25T02:12:24.234Z, message: "User clicked the page My Account", UserID: 42342342  
date: 2016-10-25T02:12:27.234Z, message: "User added item", UserID: 42342342  
date: 2016-10-25T02:12:30.234Z message: Session ended "My Account", UserID: 42342342

In the above sample, I would like to slice and bucket the middle two logs for different sessions.

Thank you,  
Satheesh

---

<div class="post-metadata">

**Author:** ![danielmitterdorfer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmitterdorfer/32/110510_2.png) [@danielmitterdorfer](https://discuss.elastic.co/u/danielmitterdorfer)\
**Post date:** [November 14, 2016, 9:46am UTC](https://discuss.elastic.co/t/slice-logs-based-on-start-and-end-of-an-user-session/65856/2 "2016-11-14T09:46:54Z")

</div>

Hi @satheeshravir,

you want to look for "entity centric indexing". This talk from Mark should get you started: [https://www.elastic.co/videos/entity-centric-indexing-mark-harwood](https://www.elastic.co/videos/entity-centric-indexing-mark-harwood)

Daniel

---

<div class="post-metadata">

**Author:** ![satheeshravir](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@satheeshravir](https://discuss.elastic.co/u/satheeshravir)\
**Post date:** [November 21, 2016, 10:34pm UTC](https://discuss.elastic.co/t/slice-logs-based-on-start-and-end-of-an-user-session/65856/3 "2016-11-21T22:34:50Z")

</div>

Thank you. I have checked that before. I wanted to see whether there is any other way of solving the problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 19, 2016, 10:35pm UTC](https://discuss.elastic.co/t/slice-logs-based-on-start-and-end-of-an-user-session/65856/4 "2016-12-19T22:35:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.