Filter out two keywords from similiar lines

Elastic Stack Logstash
1

Hi, I'm going to filter out user and result(Failed/error/Accepted) from below lines.

Failed password for root from 172.16.81.178 port 55152 ssh2

Accepted password for root from 172.16.81.178 port 55152 ssh2

Accepted keyboard-interactive/pam for root from 172.16.81.178 port 55199 ssh2

error: PAM: Failure setting user credentials for hongquan from 172.16.232.202

error: PAM: Authentication failure for root from 172.16.81.178

What I expect is:

Failed, root
Accepted,root
error, hongquan
error,root

Actually I did it by writing 2 similiar grok filters, which is pretty ugly.

Thanks.

2

seems this works.

//match => [ "message", "%{WORD:method} (.*) for %{USERNAME:user} from %{IP:src_host}" ]

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.