# Aggregate secure/sshd syslog event based on selected events

**URL:** <https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249>\
**Category:** Logstash\
**Created:** [March 22, 2023, 12:51pm UTC](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249 "2023-03-22T12:51:37Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![jun.7.6](https://avatars.discourse-cdn.com/v4/letter/j/df788c/32.png) [@jun.7.6](https://discuss.elastic.co/u/jun.7.6)\
**Post date:** [March 27, 2023, 12:23am UTC](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249/22 "2023-03-27T00:23:59Z")

</div>

Sorry if my question is unclear. So basically, I just want to ensure that the user-id seen on the first event and last event match. Therefore, I have store the user-id in the map as a variable called **sourceUserid** in the first `if` statement.

```auto
m = event.get("message").match(/Accepted password for (\w+) from (.*) port (\d+)/)
                    map["sourceUserid"] = m[1]

```

Then by doing a comparison in the `else if` statement using the `map["sourceUserid"] in [@metadata][restOfLine]`:

```auto
else if [@metadata][restOfLine] =~ /session closed/ && map["sourceUserid"] in [@metadata][restOfLine]

```

I tried this but it just doesn't allow to do so. Just wondering what can be done?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 27, 2023, 2:50am UTC](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249/23 "2023-03-27T02:50:35Z")

</div>

> [@jun.7.6](#):
>
> Just wondering what can be done?

No, I don't think this is possible.

Also, what is the logic behind this conditional? You are already using a unique identifier with the program name + pid to aggregate, and from what you shared this will already match the login event and the logout event.

If you want to use the user name as the identifier for the aggregate filter you would need to parse the field `[@metadata][restOfLine]` in both types of message and create a field with the user name as the value.

---

<div class="post-metadata">

**Author:** ![jun.7.6](https://avatars.discourse-cdn.com/v4/letter/j/df788c/32.png) [@jun.7.6](https://discuss.elastic.co/u/jun.7.6)\
**Post date:** [March 27, 2023, 6:10am UTC](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249/24 "2023-03-27T06:10:45Z")

</div>

I realized that the sshd[id] is consistent for all the sshd event for root account. But for other users, the sshd[id] might be different between the event, and only consistent for first and last event.

Therefore, I would like to use the username as another identifier to cross check in the `else if` statement. Just in case there are "same" program name + pid received by multiple input.

How would you parse the field ` [@metadata][restOfLine]` since the username are located in different section in the message:

1. \<86\>Mar 24 12:13:13 localhost sshd[19655]: Accepted password for **userA** from 10.8.4.23 port 55064 ssh2
2. \<86\>Mar 24 12:13:16 localhost sshd[19655]: pam\_unix(sshd:session): session closed for user **userA**

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 27, 2023, 12:34pm UTC](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249/25 "2023-03-27T12:34:42Z")

</div>

> [@jun.7.6](#):
>
> But for other users, the sshd[id] might be different between the event, and only consistent for first and last event.

So, what is the issue then? You are aggregating the first and last event already.

```auto
<86>Mar 24 12:13:13 localhost sshd[19655]: Accepted password for userA from 10.8.4.23 port 55064 ssh2
<86>Mar 24 12:13:16 localhost sshd[19655]: pam_unix(sshd:session): session closed for user userA

```

In those two messages the `sshd[id]` is the same.

> [@jun.7.6](#):
>
> But for other users, the sshd[id] might be different between the event

Can you share an example of it? The messages you shared have the same process and PID.

Also, if you use the user name to aggregate you will not be able to different between different connections.

---

<div class="post-metadata">

**Author:** ![jun.7.6](https://avatars.discourse-cdn.com/v4/letter/j/df788c/32.png) [@jun.7.6](https://discuss.elastic.co/u/jun.7.6)\
**Post date:** [April 12, 2023, 1:19pm UTC](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249/26 "2023-04-12T13:19:55Z")

</div>

You are right. I should not be worried about that. Anyway, thanks for your help. I have make some minor adjustment to fit my uses case and it's working now. Appreciate it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 10, 2023, 1:20pm UTC](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249/27 "2023-05-10T13:20:44Z")

</div>

Closed on May 10, 2023, 1:20pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249.md?page=1)