利用elk系统记录分析所有服务器ssh登录信息

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /log/secure
  fields:
    log_type: secure

output.logstash:
  hosts: ["49.119.119.10:5044"]
  enabled: true
  worker: 1
  compression_level: 3
  loadbalance: true

docker-compose up -d

input {
  beats {
    port => 5044
  }
}

filter {
    grok {
      match => { "message" => ".*sshd\[\d+\]: %{WORD:status} .* %{USER:username} from.*%{IP:clientip}.*" }
    }
}

output {
 if ([status] == "Accepted" or [status] == "Failed") {
  elasticsearch {
   hosts => [ "es-master:9200" ]
   index => "secure-%{+YYYY.MM.dd}"
   }
  stdout {
   codec => rubydebug
  }
 }
}