I've setup an Elastic Stack and some Filebeat clients with System module enabled, but the SSH fields doesn't show up.
Fileset.module and fileset.name are correct, and the messages I receive in Elastic have the format
Oct 30 09:04:53 VBOX_DEB_TEST sshd: Failed password for root from 192.168.1.129 port 62167 ssh2
I've setup Filebeat to send to Logstash, but I don't know exactly why those ssh fields doesn't show up. I'm not using any custom configuration, all the settings are the default.
What I'm doing wrong?