# Filebeat 6.8 stdin ssh logs

**URL:** <https://discuss.elastic.co/t/filebeat-6-8-stdin-ssh-logs/197314>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 29, 2019, 10:19am UTC](https://discuss.elastic.co/t/filebeat-6-8-stdin-ssh-logs/197314 "2019-08-29T10:19:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Serg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/serg/32/47922_2.png) [@Serg](https://discuss.elastic.co/u/Serg)\
**Post date:** [August 29, 2019, 10:19am UTC](https://discuss.elastic.co/t/filebeat-6-8-stdin-ssh-logs/197314/1 "2019-08-29T10:19:29Z")

</div>

Hi  
I want to log ssh user commands (not attempts in auth.log ).  
I suggested that "stdin" log type could give me that chance.  
But I don't see any data in filebeat index  
Where am I wrong?

> - type: stdin  
> enabled: true

---

<div class="post-metadata">

**Author:** ![BennyInc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bennyinc/32/21751_2.png) [@BennyInc](https://discuss.elastic.co/u/BennyInc)\
**Post date:** [August 29, 2019, 10:49am UTC](https://discuss.elastic.co/t/filebeat-6-8-stdin-ssh-logs/197314/2 "2019-08-29T10:49:07Z")

</div>

The `stdin` input would allow you to read from the input for the filebeat process. If you start filebeat from the command line, you can then paste your lines into the shell, i.e. stdin.  
This is not what you're looking for.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 26, 2019, 10:49am UTC](https://discuss.elastic.co/t/filebeat-6-8-stdin-ssh-logs/197314/3 "2019-09-26T10:49:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.