# Each login/logout and failure event is populated 14 times in auditbeat index / dashboard
**URL:** https://discuss.elastic.co/t/each-login-logout-and-failure-event-is-populated-14-times-in-auditbeat-index-dashboard/243388
**Category:** Beats
**Tags:** auditbeat
**Created:** [July 31, 2020, 7:06pm UTC](https://discuss.elastic.co/t/each-login-logout-and-failure-event-is-populated-14-times-in-auditbeat-index-dashboard/243388 "2020-07-31T19:06:47Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@himanshu.mainali](https://discuss.elastic.co/u/himanshu.mainali)
#### Post date: [July 31, 2020, 7:06pm UTC](https://discuss.elastic.co/t/each-login-logout-and-failure-event-is-populated-14-times-in-auditbeat-index-dashboard/243388/1 "2020-07-31T19:06:47Z")
Time host.hostname user.name event.outcome message
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx)
## auditbeat.yml
```
auditbeat.config.modules:
```
# Glob pattern for configuration reloading
path: ${path.config}/modules.d/\*.yml
# Period on which files under path should be checked for changes
reload.period: 3m
# Set to true to enable config reloading
reload.enabled: false
# Maximum amount of time to randomly delay the start of a dataset. Use 0 to
# disable startup delay.
auditbeat.max\_start\_delay: 10s
# Average scan rate. This throttles the amount of CPU and I/O that Auditbeat
scan\_rate\_per\_sec: 2 MiB
##################################################################
auditbeat.modules:
- module: auditd
audit\_rule\_files: ['${path.config}/audit.rules.d/\*.conf']
resolve\_ids: true
failure\_mode: silent
backlog\_limit: 8196
rate\_limit: 0
include\_raw\_message: false
include\_warnings: false
- module: file\_integrity
paths:
- module: system
datasets: [host,login]
period: 5m
#----------------------------- Logstash output --------------------------------
output.logstash:
# The Logstash hosts
## hosts: ["10.xx.xx.xx:5050"]
---
### Author:  [@himanshu.mainali](https://discuss.elastic.co/u/himanshu.mainali)
#### Post date: [July 31, 2020, 7:08pm UTC](https://discuss.elastic.co/t/each-login-logout-and-failure-event-is-populated-14-times-in-auditbeat-index-dashboard/243388/2 "2020-07-31T19:08:07Z")
version used: auditbeat-7.7.0-1.x86\_64
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 28, 2020, 9:08pm UTC](https://discuss.elastic.co/t/each-login-logout-and-failure-event-is-populated-14-times-in-auditbeat-index-dashboard/243388/3 "2020-08-28T21:08:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.