How-To: Export a List of Users

You can access a list of users through the UI, but if you want a text list of users, or a list to be used for auditing or verification purposes you need to export the list of users from your LogScale instance. There are a few different options available.

Using GraphQL

If you want to export a list of users and any associated data, you can use a GraphQL query through the GraphiQL interface or through the command line. To do this, you need to construct a query that accesses the user object and the fields from the user object you need.

There are additional fields that you might want to include within your search, for example to extract the email of the user, or determine whether they are the owner of an organization (the organization root). You can do this be expanding the list of fields in the query:

Note

Organisation owners cannot list users. For an alternative, see Using usersPage

json

{
  users {
     firstName
     lastName
     username
  }
}

The query returns the requested fields as a nested list of JSON objects:

json

{
  "data": {
    "users": [
      {
        "firstName": "Martin",
        "lastName": "Smith",
        "username": "developer"
      },
      {
        "firstName": "Dave",
        "lastName": "Johnson",
        "username": "dave"
      },
      {
        "firstName": "Phil",
        "lastName": "Brown",
        "username": "phil"
      },
      {
        "firstName": "John",
        "lastName": "Smith",
        "username": "john"
      }
    ]
  }
}

From the command-line using curl:

shell

$ curl -v -XPOST -H "Content-Type: application/json" \
     http://humio.example.com/graphql \
 -d '{ "query": "{ accounts { username } }" }'

Alternatively, to determine the group they are a member of you add the groups field and include the displayName to get the name of each group:

json

{
  users {
    id
    isRoot
    isOrgRoot
    createdAt
    email
    groups {
      id
      displayName
    }
  }
}

Note that the groups block is output only users that have been made part of a group.

json

{
  "data": {
    "users": [
      {
        "isRoot": true,
        "email": null,
        "isOrgRoot": true,
        "groups": [
          {
            "id": "IIp50mVkLZknQ6qthB5mdwiMJmwME0br",
            "displayName": "humio.members"
          }
        ],
        "createdAt": "2021-09-01T16:45:05.696Z",
        "id": "445nrP4AVFvWYq5EYvaNOi2Y"
      },
      {
        "isRoot": false,
        "email": null,
        "isOrgRoot": false,
        "groups": [],
        "createdAt": "2021-09-05T09:26:18.349Z",
        "id": "6KEeKjJBDxM8Ty2ztTEOEwRM"
      },
      {
        "isRoot": false,
        "email": null,
        "isOrgRoot": false,
        "groups": [],
        "createdAt": "2021-09-05T09:25:57.151Z",
        "id": "J1BaNC1EvaHvGTU4FG8bzPxv"
      },
      {
        "isRoot": false,
        "email": null,
        "isOrgRoot": false,
        "groups": [],
        "createdAt": "2021-09-05T09:25:51.328Z",
        "id": "vxtgZC5EsDeSceAUFNaCCcEr"
      }
    ]
  }
}

Using usersPage

To access a list of users as an organization owner when you are not an organization owner you can use the usersPage(). The pageSize defines the number of users to return in a single page; the pageNumber is the page to be displayed. Page 1 shows the first 2000, page 2 shows 2001-4000 and so on:

graphql

query {
  usersPage(pageSize: 2000, pageNumber: 1) {
    page {
      username
      displayName
      email
    }
  }
}

Using humioctl

You can also obtain a list of users using the humioctl command-line interface:

shell

$ ./bin/humioctl users list
Username   Name  Root  Created
developer        yes   2021-09-01T16:45:05.696Z  445nrP4AVFvWYq5EYvaNOi2Y
dave             no    2021-09-05T09:26:18.349Z  6KEeKjJBDxM8Ty2ztTEOEwRM
phil             no    2021-09-05T09:25:57.151Z  J1BaNC1EvaHvGTU4FG8bzPxv
john             no    2021-09-05T09:25:51.328Z  vxtgZC5EsDeSceAUFNaCCcEr

For more information, see humioctl.

Querying LogScale Repo

Another way to get a list of user activity within LogScale is to query the humio repository and look for log entries containing the string c.h.u.Users$ string. This shows all activity involving this class within LogScale. For example:

syslog

2021-09-05T10:25:51.333+0100 [humio-gql-mutations-434] INFO  c.h.u.Users$ 1 - creating user id=vxtgZC5EsDeSceAUFNaCCcEr, email=john, isroot=false
2021-09-05T10:25:57.153+0100 [humio-gql-mutations-436] INFO  c.h.u.Users$ 1 - creating user id=J1BaNC1EvaHvGTU4FG8bzPxv, email=phil, isroot=false
2021-09-05T10:26:01.455+0100 [humio-gql-mutations-437] INFO  c.h.u.Users$ 1 - creating user id=zbG8kWWUnctRWytiGL9nMc6e, email=dav, isroot=false

Because you are accessing a list of the activities that create the user, rather than the current user list, this method can be used to determine the historic user configuration.

Knowledge Base