# User history request & Logs

**URL:** <https://discuss.elastic.co/t/user-history-request-logs/91292>\
**Category:** Elasticsearch\
**Created:** [June 29, 2017, 1:46pm UTC](https://discuss.elastic.co/t/user-history-request-logs/91292 "2017-06-29T13:46:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![baillema](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baillema/32/19650_2.png) [@baillema](https://discuss.elastic.co/u/baillema)\
**Post date:** [June 29, 2017, 1:46pm UTC](https://discuss.elastic.co/t/user-history-request-logs/91292/1 "2017-06-29T13:46:40Z")

</div>

Hello,

I am actually trying to index user history request in ElasticSearch but I did't succeded.  
I come here to know if there is a solution or an alternative to do what I want.

My configuration :

- ElasticSearch witch X-pack (to define **users** )
- Kibana with X-pack
- FileBeat to take log from ElasticSearch (_slowlog_ and _access\_log_)
- Logstash to filter log comming from FileBeat and index in ElasticSearch

So, I wanted to mix _slowlog_ and _access\_log_ to have something like this :

- Time : the _@timestamp_ of the request
- User : the user who wrote the request
- Index : one or more indexes
- Request : something like _{"match":{...}}_

The problem is that the **User** is in the _access\_log_ and the **Request** in _slowlog_ and I can't link the two because the only connection between the two logs is **Index**. The _@timestamp_ can't be used because it don't fit between the logs.

Is there a solution that I did't seen or an alternative ?

Thank you for your attention.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2017, 1:47pm UTC](https://discuss.elastic.co/t/user-history-request-logs/91292/2 "2017-07-27T13:47:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
