29 lines
541 B
Plaintext
29 lines
541 B
Plaintext
|
<source>
|
||
|
|
@type tail
|
||
|
|
path /var/log/auth.log
|
||
|
|
pos_file /var/log/td-agent/auth.pos
|
||
|
|
format syslog
|
||
|
|
tag auth
|
||
|
|
</source>
|
||
|
|
|
||
|
|
<filter auth>
|
||
|
|
@type record_transformer
|
||
|
|
<record>
|
||
|
|
message ${hostname}: ${record["message"]}
|
||
|
|
</record>
|
||
|
|
</filter>
|
||
|
|
|
||
|
|
<filter auth>
|
||
|
|
@type grep
|
||
|
|
|
||
|
|
<exclude>
|
||
|
|
key message
|
||
|
|
pattern (CRON|Did not receive identification string from|sudo|pam_unix|seat|Removed session|Received disconnect|New session|Accepted publickey|Disconnected)
|
||
|
|
</exclude>
|
||
|
|
</filter>
|
||
|
|
|
||
|
|
<match auth>
|
||
|
|
@type relabel
|
||
|
|
@label @forward
|
||
|
|
</match>
|