logstash.conf

input {
  beats {
    port => 5044
  }
}

filter {
  grok {
    match => {
      "message" => "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:hostname} sshd\[%{NUMBER:pid}\]: %{WORD:statut} %{WORD:auth_method} for %{USERNAME:user} from %{IP:IP} port %{NUMBER:port} %{WORD:protocol}"
    }
    overwrite => ["message"]
  }

  date {
    match => ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    target => "@timestamp"
  }

  mutate {
    remove_field => ["@version", "host", "agent", "ecs", "input", "log", "event", "timestamp"]
  }

  geoip {
    source => "IP"
    target => "geoip"
    fields => ["city_name", "country_name", "location"]
  }
}

output {
  elasticsearch {
    hosts => ["http://elasticsearch:9200"]
    index => "raw-ssh-logs-%{+YYYY.MM.dd}"
  }

  stdout {
    codec => rubydebug
  }
}