check that doesn't seem to work

    #check to see if the 2 username fields are the same, if they are merge them and remove old fields, if they are not alert
    if [user_session] and [user_service] and [user_session] != [user_service] {
      mutate {
        add_tag => [ "alert" ]
      }
    }
    else {
      mutate {
        add_field => { "samba_user" => "%{user_session}" }
        remove_field => [ "user_session", "user_service" ]
      }
    }