Ssh login fail events on kibana through filebeat

[gkulkarni (GK)]

Hi,
Can someone help how to get events for failed ssh login attempts on Kibana dashboard?

I'm using linux as host with filebeat installed. Should i install logstash as well in the host?

-Thaks

[shaunak (Shaunak Kashyap)]

Hi @gkulkarni, welcome to the Elastic Community Forums!

Have you considered using Auditbeat to collect and visualize failed SSH login attempts? See https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-overview.html, https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-system.html, and https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-dataset-system-login.html.

Cheers,

Shaunak