Filebeat module system don't parse auth log

Elastic Stack Beats
1

Hello all,

I am using Filebeat 7.12.1 with the system module
The logs send in Elastic without problem, but some failed authentication logs from pam_unix(sshd:auth) are not parsed.
Do you know why?

Elastic_filebeat_system_auth
Elastic_filebeat_system_auth1062×78 8.1 KB

Thank you very much !
Guillaume

2

Nobody has any ideas ? :frowning:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.