logstash.conf

filter {
  grep {
    match => ["message", "sshd"]
    add_tag => ["sshd"]
  }

  grep {
    match => ["message", "sshd.+Invalid user .+ from "]
    add_tag => ["sshd_invalid_user"]
  }

  grep {
    match => ["message", "sshd.+Received disconnect from "]
    add_tag => ["sshd_disconnect"]
  }

  grep {
    match => ["message", "sshd.+Accepted"]
    add_tag => ["sshd_connect"]
  }

  grok {
    tags => ["sshd_invalid_user"]
    pattern => "%{MONTH:month} %{MONTHDAY:day} %{TIME} %{HOSTNAME:hostname} sshd\[%{INT:pid}\]: Invalid user %%{WORD:username} from %{IP:client}"
  }

  grok {
    tags => ["sshd_disconnect"]
    pattern => "%{MONTH:month} %{MONTHDAY:day} %{TIME} %{HOSTNAME:hostname} sshd\[%{INT:pid}\]: Received disconnect from %%{IP:client}.* \[%{WORD:method}\]"
  }

  grok {
    tags => ["sshd_connect"]
    pattern => "%{MONTH:month} %{MONTHDAY:day} %{TIME} %{HOSTNAME:hostname} sshd\[%{INT:pid}\]: Accepted %{WORD:method} for %%{WORD:username} from %{IP:client} port %{INT:port}"
  }
}