# How we can add extra field in SSH Login Attempt \[Filebeat System\] dashboard **URL:** \ **Category:** Kibana\ **Created:** [October 30, 2018, 6:50am UTC](https://discuss.elastic.co/t/how-we-can-add-extra-field-in-ssh-login-attempt-filebeat-system-dashboard/154569 "2018-10-30T06:50:54Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Post date:** [October 30, 2018, 6:50am UTC](https://discuss.elastic.co/t/how-we-can-add-extra-field-in-ssh-login-attempt-filebeat-system-dashboard/154569/1 "2018-10-30T06:50:54Z")
Hello Team, I am using ELK 6.4.0 and Beat (Filebeat). My architecture is Filebeat-\>Logstash-\>Elasticsearch-\>Kibana. I am sending my `auth.log` using filebeat but i am not using filebeat system module. Because Filebeat system module can't use directly with logstash. So i am using logstash pipeline. I have created a field for a auth log and this filed is visible on kibana dashboard. But now i want to add this field into my `SSH Login Attempt` dashboard. So i have tried to add my newly created filed in saved searches for SSH Login Attempt dashboard and fields were showing in left hand side on dashboard but my newly created field is not present in that list. Can you please help me how we can add that filed? Any assistance will be appreciated. Thanks. ---
**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Post date:** [October 30, 2018, 8:53am UTC](https://discuss.elastic.co/t/how-we-can-add-extra-field-in-ssh-login-attempt-filebeat-system-dashboard/154569/2 "2018-10-30T08:53:32Z")
i have done it. Thanks. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [October 30, 2018, 4:14pm UTC](https://discuss.elastic.co/t/how-we-can-add-extra-field-in-ssh-login-attempt-filebeat-system-dashboard/154569/3 "2018-10-30T16:14:59Z")
Hey @Tek_Chand, I'm glad to hear you were able to solve your issue. If you get the chance, if you could share what you did to resolve your issue, it can help others that are having similar issues. ---
**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Post date:** [October 31, 2018, 4:14am UTC](https://discuss.elastic.co/t/how-we-can-add-extra-field-in-ssh-login-attempt-filebeat-system-dashboard/154569/4 "2018-10-31T04:14:35Z")
@Brandon_Kobel, > [@Brandon\_Kobel](#): > > If you get the chance, if you could share what you did to resolve your issue, it can help others that are having similar issues. Sure, i have followed the below `steps`: As i mentioned in my first post that i am using logstash pipeline to use the Filebeat Dashboards. 1. I have write the Grok pattern for my log line with all the required field which i need. 2. Now restarted the logstash service in order made my changes effective. 3. Now all the required fields were visible on Kibana dashboard. Now we need to add our required field in SSH Login Attempt [Filebeat] dashboard. We can add the filed according to us by making the changes in `Saved Searches` for SSH Login Attempt Dashboard. We can reach there by following the below step: 1. Click on `Discover` tab on left hand site on kibana dashboard. 2. Now click on `Open` tab on right hand top corner in Kibana dashboard. 3. Now you will see the list of many saved serches and choose SSH Login Attempt Dashboard. 4. Once you open that dashboard in new tab you will see the list of all by defaults fields on left hand side of kibana dashbaord. Now you can add or remove as per your requirements. 5. After making changes click on `save` tab on kibana dashboard. Save without selecting `save as new serach`. > [@Tek\_Chand](#): > > So i have tried to add my newly created filed in saved searches for SSH Login Attempt dashboard and fields were showing in left hand side on dashboard but my newly created field is not present in that list. I got above issue because earlier when i wrote my grok pattern none of the field were match with any by default fileds available in `SSH Login Attempt` dashboard. So again i made some changes in my Grok pattern and give the one field name as it is which available in by default fields. Now when i follow that same steps again to make changes in my SSH Login Attempts Dashboard and i saw all the newly created fields in list. Above steps may be not quite clear. But i am hoping it will give a lead in that direction. 🙂 Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2018, 4:14am UTC](https://discuss.elastic.co/t/how-we-can-add-extra-field-in-ssh-login-attempt-filebeat-system-dashboard/154569/5 "2018-11-28T04:14:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.