Merge pull request #15 from afeefghannam89/rebuild-#14

Rebuild #14

Author: afeefghannam89

README.md

@@ -1,4 +1,4 @@
-# secure-logstash-pipeline
+# ssh-logstash-pipeline
 
 ## Input and Output ##
 
@@ -10,7 +10,7 @@ Here are examples how your files could look if you want to use a local Redis ins
 input {
   redis {
     host => localhost
-    key => "secure"
+    key => "ssh"
     data_type => list
   }
 }

filter-50-secure-sudo.conf

@@ -1,5 +1,4 @@
 filter {
-  if [process][name] == "sshd" or [journald][process][name] == "sshd" {
     if [message] =~ /^(Accepted|Failed)/ {
       grok {
         match => ["message", "%{WORD:[ssh][auth][result]} %{WORD:[ssh][auth][method]} for (invalid user )?%{USERNAME:[user][name]} from %{IPORHOST:[client][address]} port %{NUMBER:[client][port]} %{WORD:[ssh][protocol]}(: %{GREEDYDATA:[ssh][signature]})?"]
@@ -45,5 +44,4 @@ filter {
         }
       }
     }
-  }
 }