title: Combine logs and query in ELK
body: <p>With ELK (Elasticsearch-Logstash-Kibana) stack, I collect syslog logs from *nix boxes to Logstash and send it to Kibana via Elasticsearch. This is classical one scenario.</p>
  
  <p>My syslog log includes normal system events, squid access log, captiveportal login logs etc.
  captiveportal logged as </p>
  
  <pre><code>1423548430 2582 192.168.1.23 xx:ae:xx:e1:xx:99 mike.brown cc9aeb1210b39571 MTI= first
  </code></pre>
  
  <p>and</p>
  
  <p>squid access logs logged as:</p>
  
  <pre><code>1423562965.228    482 192.168.1.23 TCP_MISS/200 1254 POST http://ad4.liverail.com/? - DIRECT/31.13.93.12 text/xml
  </code></pre>
  
  <p>In Logstash, I have filtered captive portal log, and I have got <code>client_ip="192.168.1.23"</code>, <code>user_name="mike.brown"</code> and also in different filter in Logstash configuration I have also filtered squid access log, and I have got <code>src_ip="192.168.1.23"</code>.</p>
  
  <p><strong>My question is:</strong> How can I query to get user_name where client_ip of squid access log equals to src_ip of captive portal in Kibana?</p>