# Ship /var/log/secure onto Elasticsearch

**URL:** <https://discuss.elastic.co/t/ship-var-log-secure-onto-elasticsearch/153659>\
**Category:** Logstash\
**Created:** [October 23, 2018, 5:23pm UTC](https://discuss.elastic.co/t/ship-var-log-secure-onto-elasticsearch/153659 "2018-10-23T17:23:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rrs](https://avatars.discourse-cdn.com/v4/letter/r/d9b06d/32.png) [@rrs](https://discuss.elastic.co/u/rrs)\
**Post date:** [October 23, 2018, 5:23pm UTC](https://discuss.elastic.co/t/ship-var-log-secure-onto-elasticsearch/153659/1 "2018-10-23T17:23:16Z")

</div>

Hi Team,

We have setup ELK with 5.6.3 to forward all RHEL/Centos system logs. Initially, we are in process of shipping /var/log/secure logs which file has different events such as ssh, su, and sudo events each with different pattern log lines.

Can you please help me to how to achieve this. Should I make indices for each ssh success/failure/logged out, su, and sudo ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2018, 5:23pm UTC](https://discuss.elastic.co/t/ship-var-log-secure-onto-elasticsearch/153659/2 "2018-11-20T17:23:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.