Winlogbeat/Kibana how to visualize a user logon time over 1 month?

Hi all,

I am trying to visualize in some way the first initial logon time for a user each day over a month, is this possible ? everything just seems to be based on count and i cant figure out the best way to do it.

eg - graph with each date for the month and a time shown on the chart or something similar.


@Marius_Dragomir please?


Hi Gary,

  1. First of all, make sure you have winlogbeat run with admin permissions, otherwise the Security events won't be collected.
  2. Create a scripted field called hour_of_day with the following value:

Set the Type to Number, the format to Duration, Input format to Minutes, Output format to Hours. There is a small hitch here, as it will show the time with decimal points for Hours instead of minutes, I've added an issue to make this more useful.
3. Create a visualization (i used a bar chart), with the following settings:

  • enter event_id:4624 in the search bar or as a filter: this is the event ID for all successful logons in Windows.
  • On the Y-Axis set to Top hit aggregation, on the field hour_of_day, with Aggregate on set to Min, Size set to 1,Sort onset to @timestamp field,Order` as ascending.
  • On the X-Axis, set to a Date Histogram, on the @timestamp field, with a Daily interval.

Optional, you can split the series with a Terms aggregation, on the field to show the top X users (as many as you set in the Size field), or even better, do a Filter aggregation instead of terms and add a filter for each user that you're interested in, something like this:

You can see how this chart would look over here:

You can get ideas for more cool stuff to do with the Winlogbeat data from this blog post:

Thank you, I'm very new to Elastic Search so i had to work out how to add a scripted field but once done the chart has worked perfectly, thanks !

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.