# Aggregate secure/sshd syslog event based on selected events

**URL:** <https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249>\
**Category:** Logstash\
**Created:** [March 22, 2023, 12:51pm UTC](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249 "2023-03-22T12:51:37Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 23, 2023, 2:30am UTC](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249/9 "2023-03-23T02:30:40Z")

</div>

I'm sorry, I made the mistake of assuming that your messages had the format that you showed in your original question. You can change the dissect

```
dissect { mapping => { "message" => "<%{}>%{[@metadata][ts]} %{} %{[@metadata][program]}: ...

```

to fix the \_dissectfailure issues.

> [@](#):
>
> I have tested your code but it is still stdout all the sshd event[program]}:

Not sure what you mean by this. My code modifies the "session closed" message to include details from the "Accepted password for test\_user" message. If you only want those two message kept you could change

```
if [@metadata][restOfLine] =~ /Accepted .* for \w+ from/ {
    ....
} else if [@metadata][restOfLine] =~ /session closed/ {
    ....
}

```

to

```
if [@metadata][restOfLine] =~ /Accepted .* for \w+ from/ {
    ....
} else if [@metadata][restOfLine] =~ /session closed/ {
    ....
} else {
    drop {}
}

```

I cannot see a use case where I would want that.

---

_[View the full topic](https://discuss.elastic.co/t/aggregate-secure-sshd-syslog-event-based-on-selected-events/328249)._