新手求助，如何按月聚合查询test共享目录的被哪些用户访问了多少次？？？1

@timestamp June 11th 2018, 11:28:22.486
t _id afzQ7GMB_fzoToqi3HNj
t _index winlogbeat-6.2.4-2018.06.11
# _score 1
t _type doc
t beat.hostname file
t beat.name file
t beat.version 6.2.4
t computer_name file.test.com
t event_data.AccessList %%4416 %%4423
t event_data.AccessMask 0x81
t event_data.AccessReason %%4416: D:(A;OICI;FA;;;WD) %%4423: D:(A;OICI;FA;;;WD)
t event_data.IpAddress 172.16.16.130
t event_data.IpPort 57087
t event_data.ObjectType File
t event_data.RelativeTargetName :AFP_AfpInfo
t event_data.ShareLocalPath \??\D:\Public Files\test
t event_data.ShareName \\*\test
t event_data.SubjectDomainName test
t event_data.SubjectLogonId 0x2a13da07
t event_data.SubjectUserName test01
t event_data.SubjectUserSid S-1-5-21-1001183007-3514064082-2647572773-8709
# event_id 5,145
t keywords 审核成功
t level 信息
t log_name Security
t opcode 信息
# process_id 568
t provider_guid {54849625-5478-4994-A5BA-3E3B0328C30D}
t record_number 30123324
t source_name Microsoft-Windows-Security-Auditing
t task 详细的文件共享
# thread_id 580
t type wineventlog11