# Ship login history
**URL:** https://discuss.elastic.co/t/ship-login-history/255437
**Category:** Beats
**Tags:** filebeat
**Created:** [November 15, 2020, 1:12pm UTC](https://discuss.elastic.co/t/ship-login-history/255437 "2020-11-15T13:12:42Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@headtea](https://discuss.elastic.co/u/headtea)
#### Post date: [November 15, 2020, 1:12pm UTC](https://discuss.elastic.co/t/ship-login-history/255437/1 "2020-11-15T13:12:42Z")
On all servers, I use Filebeat and Auditbeat. While I use filebeat for all sorts of things - I only use auditbeat to ship system logins (who attempted to log-on, from where, successful or not). [It comes with Auditbeat's default dashboard "Login Dashboard ECS"](https://us1.discourse-cdn.com/elastic/original/3X/5/1/51a118918b3eec545b8e194fb110861955788786.png).
Problem is, I have about 10 CentOS 5 machines that can only run Filebeat (Auditbeat is not working on it).
Is it possible to ship the same data with Filebeat? This is an example of what a login entry looks like from Auditbeat:
```
Login by user root (UID: 0) on pts/0 (PID: 1715) from 172.19.14.55 (IP: 172.19.14.55)
```
Also, is it possible to have the data end up in the same Auditbeat dashboard?
Thanks ahead.
---
### Author:  [@headtea](https://discuss.elastic.co/u/headtea)
#### Post date: [November 15, 2020, 2:57pm UTC](https://discuss.elastic.co/t/ship-login-history/255437/2 "2020-11-15T14:57:22Z")
I thought about `/var/log/secure` and while I'll definitely try it as an alternative, it has a different format than the one from the snippet code which is from `/var/log/wtmp`. One obstacle is that it's a binary file. Is possible to have filebeat read from that? And is it possible to have the data shipped into the auditbeat dashboard?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 13, 2020, 4:57pm UTC](https://discuss.elastic.co/t/ship-login-history/255437/3 "2020-12-13T16:57:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.