Hi
I want to log ssh user commands (not attempts in auth.log ).
I suggested that "stdin" log type could give me that chance.
But I don't see any data in filebeat index
Where am I wrong?
- type: stdin
enabled: true
The stdin input would allow you to read from the input for the filebeat process. If you start filebeat from the command line, you can then paste your lines into the shell, i.e. stdin.
This is not what you're looking for.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.