ELK - SSH 登陆日志分析

正则表达式
91221.elk.node1.com<2016-12-14 16:06:15> /opt/logstash-2.4.1/patterns
root># cat syslog
SECURELOG %{WORD:program}[%{DATA:pid}]: %{WORD:status} password for ?(invalid user)? %{WORD:USER} from %{DATA:IP} port

logstash配置文件
91221.elk.node1.com<2016-12-14 16:07:07> /opt/logstash-2.4.1/conf
root># cat sys_log.conf
input {
file {
type => "seclog"
path => "/var/log/secure"
}
}
filter {
if [type] == "seclog" {
grok {
match => { "message" => "%{SYSLOGPAMSESSION}" }
match => { "message" => "%{SECURELOG}" }
match => { "message" => "%{SYSLOGBASE2}" }
}
geoip {
source => "IP"
fields => ["city_name"]
database => "/opt/logstash-2.4.1/conf/GeoLiteCity.dat"
}
if ([status] == "Accepted") {
mutate {
add_tag => ["Success"]
}
}
else if ([status] == "Failed") {
mutate {
add_tag => ["Failed"]
}
}

}

}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["192.168.91.221:9200", "192.168.91.222:9200", "192.168.91.223:9200"]
#hosts => ["192.168.91.221:9200"]
index => "sshd_log-%{+YYYY.MM}"
}
}