# Auditd

**URL:** <https://discuss.elastic.co/t/auditd/64506>\
**Category:** Logstash\
**Created:** [November 1, 2016, 1:10am UTC](https://discuss.elastic.co/t/auditd/64506 "2016-11-01T01:10:34Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![brunopsitech](https://avatars.discourse-cdn.com/v4/letter/b/eb9ed0/32.png) [@brunopsitech](https://discuss.elastic.co/u/brunopsitech)\
**Post date:** [November 1, 2016, 1:10am UTC](https://discuss.elastic.co/t/auditd/64506/1 "2016-11-01T01:10:35Z")

</div>

Hi, someone know how to load audit.log of linux in Logstash ?

I try use this but not work:  
input {  
file {  
path =\> ["/var/log/audit/audit.log"]  
type =\> "auditd"  
start\_position =\> beginning  
}  
}  
filter {

}  
output  
{  
elasticsearch {  
action =\> "index"  
user =\> "elastic"  
password =\> "system"  
hosts =\> ["127.0.0.1"]  
document\_type =\> "auditd-%{type}-%{+YYYY.MM.dd}"  
index =\> "auditd"  
}  
}

I need something to transform = in : and load

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 1, 2016, 6:36am UTC](https://discuss.elastic.co/t/auditd/64506/2 "2016-11-01T06:36:31Z")

</div>

Please show an example of what you want to parse. I don't have a /var/log/audit/audit.log on my Debian system.

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [November 2, 2016, 11:13am UTC](https://discuss.elastic.co/t/auditd/64506/3 "2016-11-02T11:13:06Z")

</div>

What version of Logstash are you using?  
What is the last modified date of that file?

---

<div class="post-metadata">

**Author:** ![brunopsitech](https://avatars.discourse-cdn.com/v4/letter/b/eb9ed0/32.png) [@brunopsitech](https://discuss.elastic.co/u/brunopsitech)\
**Post date:** [November 4, 2016, 11:46am UTC](https://discuss.elastic.co/t/auditd/64506/4 "2016-11-04T11:46:30Z")

</div>

type=SERVICE\_STOP msg=audit(1478259961.432:18703): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=user@360 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

---

<div class="post-metadata">

**Author:** ![brunopsitech](https://avatars.discourse-cdn.com/v4/letter/b/eb9ed0/32.png) [@brunopsitech](https://discuss.elastic.co/u/brunopsitech)\
**Post date:** [November 4, 2016, 11:46am UTC](https://discuss.elastic.co/t/auditd/64506/5 "2016-11-04T11:46:45Z")

</div>

I am using version 5

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 4, 2016, 3:27pm UTC](https://discuss.elastic.co/t/auditd/64506/6 "2016-11-04T15:27:03Z")

</div>

A kv filter should get you far. You might actually need two kv filters since the msg value contains another string of key=value pairs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:31am UTC](https://discuss.elastic.co/t/auditd/64506/7 "2017-07-06T04:31:03Z")

</div>