Dear all, I installed filebeat on my server, and it's configured to read the auth.log file. The information in the auth.log file is sending to ELK. In Kibana I have a JSON message with a label message. This label is a string like this : "app sshd[27546]: Failed password for root from XXX.XXX.XXX.…

Parsing message with filebeat

Michal_Pristas (Michal Pristas) April 5, 2019, 7:10am 2

Hey @Christophe welcome to Elastic Discuss.

Maybe you can consider using ingest node or using logstash

Topic		Replies	Views
Kibana Customize Message Beats filebeat	2	879	January 11, 2018
Create new Fields to Filter by Beats filebeat	3	396	September 10, 2019
Auth logs not parsed in filebeat 5.4.0 Beats filebeat	6	1538	July 4, 2017
Sending filebeat to logstash loses system fields Logstash	1	301	April 17, 2018
Filebeat shipping incomplete logs Beats filebeat	3	712	August 20, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Parsing message with filebeat

Related topics