syslog logstash filter

gistfile1.txt

filter {
  if [type] == "syslog" {
    grok {
      match        => { "message" => [ "%{SYSLOGPAMSESSION}", "%{CRONLOG}", "%{SYSLOGLINE}" ] }
      add_field    => [ "received_at", "%{@timestamp}" ]
      add_field    => [ "received_from", "%{host}" ]
      overwrite    => [ "message" ] # After we've processed the log we dont need the raw message anymore
    }

    grep {
      drop    => false
      match   => [ "message", "Disconnecting: Too many authentication failures for %{USER} \[preauth\]" ]
      add_tag => [ "auth_failure" ]
    }

    grep {
      drop    => false
      match   => [ "message", "Invalid user %{USER} from %{IP}" ]
      add_tag => [ "auth_failure" ]
    }

    grep {
      drop    => false
      match   => [ "message", "incorrect password attempts" ]
      add_tag => [ "auth_failure" ]
    }

    grep {
      drop    => false
      match   => [ "message", "Connection closed by %{IP} \[preauth\]" ]
      add_tag => [ "auth_failure" ]
    }

    grep {
      drop    => false
      match   => [ "message", "Accepted (publickey|password) for %{USER} from %{IP} port %{POSINT} ssh2" ]
      add_tag => [ "auth_login" ]
    }

    syslog_pri { }

    date {
      match => [ "timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}