Hello And Welcome
Maybe I can help you.
Could you explain in greater detail what you want. If you unsure please take a look at this link below. It will help us, to help you.
https://community.graylog.org/t/community-guidelines/6649#before-ask
If I was going to make a guess, I think its something like this you are wanting.
https://docs.graylog.org/en/4.0/pages/secure/sec_log_user_activity.html