move process condition to syslog pipeline

afeefghannam89 · afeefghannam89 · commit b03984d8074b · 2022-04-25T17:25:17.000+02:00
diff --git a/filter-50-secure-ssh.conf b/filter-50-secure-ssh.conf
@@ -1,5 +1,4 @@
 filter {
-  if [process][name] == "sshd" or [journald][process][name] == "sshd" {
     if [message] =~ /^(Accepted|Failed)/ {
       grok {
         match => ["message", "%{WORD:[ssh][auth][result]} %{WORD:[ssh][auth][method]} for (invalid user )?%{USERNAME:[user][name]} from %{IPORHOST:[client][address]} port %{NUMBER:[client][port]} %{WORD:[ssh][protocol]}(: %{GREEDYDATA:[ssh][signature]})?"]
@@ -45,5 +44,4 @@ filter {
         }
       }
     }
-  }
 }

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,4 @@`
`1`	`1`	`filter {`
`2`		`- if [process][name] == "sshd" or [journald][process][name] == "sshd" {`
`3`	`2`	`if [message] =~ /^(Accepted\|Failed)/ {`
`4`	`3`	`grok {`
`5`	`4`	`match => ["message", "%{WORD:[ssh][auth][result]} %{WORD:[ssh][auth][method]} for (invalid user )?%{USERNAME:[user][name]} from %{IPORHOST:[client][address]} port %{NUMBER:[client][port]} %{WORD:[ssh][protocol]}(: %{GREEDYDATA:[ssh][signature]})?"]`
`@@ -45,5 +44,4 @@ filter {`
`45`	`44`	`}`
`46`	`45`	`}`
`47`	`46`	`}`
`48`		`- }`
`49`	`47`	`}`