Hi, good day..

I want create a script who send to an ELK the total time a user was connected on the day. For example..one user_id was connected 7 hs the day 17/6/2020

I supouse if i search a log in particular.. the log out of VPN of a user_id and send de uptime for this session and accumulate this time in a variable for each session of this user. Then i can send this value with others to ELK.

How could I do this? I don't have much script experience.

One option:
How can I modify the following script to achieve the objective?

I take this script for other post to get the started (thank you for that!):

{
:local userid;
: local i;
: local realip;
: local vpnip;
: local uptime;
: local crttime;
: local crtdate;
: local logmsg;
:local userid
:global tmp1

:foreach i in=[/ppp active find] do={
:set userid [/ppp active get $i name];
:set realip [/ppp active get $i caller-id];
:set vpnip [/ppp active get $i address];
:set uptime [/ppp active get $i uptime];
:set crtdate [/system clock get date];
:set crttime [/system clock get time];

:set logmsg "TIME: $crtdate $crttime, USER_ID: $userid; REAL-IP: $realip, VPN-IP: $vpnip, UP-TIME: $uptime";
if ($tmp1!=$realip) do={:log info (" $logmsg ")};
:set tmp1 [/ppp active get $i caller-id];
}
}

I was able to send the results of the script every 5 minutes but I was unable to define the total time that was connected on the day.

I would appreciate your help.. Sorry for my english