search

freedomofpress / ansible-role-elk

Installs a turnkey ELK stack for log aggregation and analysis, with optional Riemann support for alerting
18 stars 13 forks source link

Refines alerting strategy for SSH logins #43

Closed conorsch closed 8 years ago

conorsch commented 8 years ago

Most notably leverages break_on_match => false for the SSH logins, to ensure that all possible matches are tried. Otherwise, the filter will bail out early and leave the _grokparsefailure tag assigned. Additionally filtering the syslog events to ensure that the date-parsing logic (#33) for SSH events only applies to events already tagged as "ssh".

conorsch commented 8 years ago

Running smoothly, logstash log is clean from the timestamp errors that were previously caused by the missing Z in the date parsing.