Capture specific word from message

Elastic Stack Logstash
1

Hi,

I need to create a field with the username from the message. How can i capture the username from a message and put it in a separate field?

Ex:
Feb 20 15:23:33 localhost sshd[24958]: Failed password for invalid user admin from 192.168.21.203 port 13246 ssh2

I need to capture the username which failed to login and put it in a new field.

2

How about this?

grok { match => { "message" => "invalid user %{WORD:user}" } }
3

thanks. that worked

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.