# Winlogbeat/Kibana how to visualize a user logon time over 1 month? **URL:** \ **Category:** Kibana\ **Created:** [November 23, 2018, 10:35am UTC](https://discuss.elastic.co/t/winlogbeat-kibana-how-to-visualize-a-user-logon-time-over-1-month/157990 "2018-11-23T10:35:33Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Loggeruk](https://avatars.discourse-cdn.com/v4/letter/l/48db29/32.png) [@Loggeruk](https://discuss.elastic.co/u/Loggeruk)\ **Post date:** [November 23, 2018, 10:35am UTC](https://discuss.elastic.co/t/winlogbeat-kibana-how-to-visualize-a-user-logon-time-over-1-month/157990/1 "2018-11-23T10:35:33Z")
Hi all, I am trying to visualize in some way the first initial logon time for a user each day over a month, is this possible ? everything just seems to be based on count and i cant figure out the best way to do it. eg - graph with each date for the month and a time shown on the chart or something similar. Thanks ---
**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\ **Post date:** [November 23, 2018, 2:32pm UTC](https://discuss.elastic.co/t/winlogbeat-kibana-how-to-visualize-a-user-logon-time-over-1-month/157990/2 "2018-11-23T14:32:52Z")
@Marius_Dragomir please? Thanks, Bhavya ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [November 23, 2018, 3:58pm UTC](https://discuss.elastic.co/t/winlogbeat-kibana-how-to-visualize-a-user-logon-time-over-1-month/157990/3 "2018-11-23T15:58:45Z")
Hi Gary, 1. First of all, make sure you have winlogbeat run with admin permissions, otherwise the Security events won't be collected. 2. Create a scripted field called `hour_of_day` with the following value: ```auto doc["@timestamp"].value.getMinuteOfDay() ``` Set the Type to Number, the format to Duration, Input format to Minutes, Output format to Hours. There is a small hitch here, as it will show the time with decimal points for Hours instead of minutes, I've added an issue to make this more useful. [https://github.com/elastic/kibana/issues/26128](https://github.com/elastic/kibana/issues/26128) 3. Create a visualization (i used a bar chart), with the following settings: - enter `event_id:4624` in the search bar or as a filter: this is the event ID for all successful logons in Windows. - On the Y-Axis set to `Top hit` aggregation, on the field `hour_of_day`, with `Aggregate on` set to `Min`, `Size set to 1,`Sort on`set to @timestamp field,`Order` as ascending. - On the X-Axis, set to a Date Histogram, on the @timestamp field, with a Daily interval. Optional, you can split the series with a Terms aggregation, on the user.name field to show the top X users (as many as you set in the Size field), or even better, do a Filter aggregation instead of terms and add a filter for each user that you're interested in, something like this: ![filter_users](https://us1.discourse-cdn.com/elastic/original/3X/2/1/21f6b942e030b9f59f16cf48ce206f2406666689.png) You can see how this chart would look over here: ![first_login](https://us1.discourse-cdn.com/elastic/original/3X/a/d/adbc0003b2639fcff16f42170242d64af038fdec.png) You can get ideas for more cool stuff to do with the Winlogbeat data from this blog post: [https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat](https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat) ---
**Author:** ![Loggeruk](https://avatars.discourse-cdn.com/v4/letter/l/48db29/32.png) [@Loggeruk](https://discuss.elastic.co/u/Loggeruk)\ **Post date:** [November 26, 2018, 1:08pm UTC](https://discuss.elastic.co/t/winlogbeat-kibana-how-to-visualize-a-user-logon-time-over-1-month/157990/4 "2018-11-26T13:08:06Z")
Thank you, I'm very new to Elastic Search so i had to work out how to add a scripted field but once done the chart has worked perfectly, thanks ! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 24, 2018, 1:08pm UTC](https://discuss.elastic.co/t/winlogbeat-kibana-how-to-visualize-a-user-logon-time-over-1-month/157990/5 "2018-12-24T13:08:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.