# Visualize command history **URL:** \ **Category:** Kibana\ **Created:** [June 26, 2020, 5:38pm UTC](https://discuss.elastic.co/t/visualize-command-history/238892 "2020-06-26T17:38:53Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![elk6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk6/32/72282_2.png) [@elk6](https://discuss.elastic.co/u/elk6)\ **Post date:** [June 26, 2020, 5:38pm UTC](https://discuss.elastic.co/t/visualize-command-history/238892/1 "2020-06-26T17:38:53Z")
I'm a complete noob at Elastic Stack. I need to display command history in kibana in an easy to read format, [I'm looking for something like this](http://puu.sh/G0O9J/63ad06efe1.png). For that, I've set auditbeat with this rule to log every command someone runs: `-a always,exit -F arch=b64 -S execve,execveat -F key=actionmade` However the [log that it generates is really complicated and hard to read](http://puu.sh/G0O2O/6648a1533c.png). I'm facing two things: 1. Is it possible to create a table like in the first picture? If so, could I ask for some guidance? 2. This is a more minor thing but auditbeat logs some commands that the system runs and not the user, is it possible to make it log only commands that a user enters with a shell? Thanks ahead! ---
**Author:** ![mykael](https://avatars.discourse-cdn.com/v4/letter/m/ec9cab/32.png) [@mykael](https://discuss.elastic.co/u/mykael)\ **Post date:** [June 27, 2020, 2:10pm UTC](https://discuss.elastic.co/t/visualize-command-history/238892/2 "2020-06-27T14:10:12Z")
I'd start by going into Discover on the auditbeat log and expanding a few records to find one that is actually a command history record. You'll have to hit the '\>' sign infront of it to expand it. Once you've worked out the fields you want (date, user and command), slipping them into a table is real easy - just ignore the rest of the fields. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 25, 2020, 2:10pm UTC](https://discuss.elastic.co/t/visualize-command-history/238892/3 "2020-07-25T14:10:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.