# CONFIGURED BY ANSIBLE

#
# parse auth.log for user-names and public keys
#

#[PARSER]
#    name   syslog_msg
#    format regex
#    # there might be more than one space after month name
#    regex  ^[^ ]+ +[^ ]+ [^ ]+ [^ ]+ (?<msg>.*)$

# regex against proc_name[proc_pid]: situation
#[PARSER]
#    name   name_pid_msg
#    format regex
#    regex  ^(?<proc_name>[^\[]+)\[(?<proc_pid>[0-9]+)\]: (?<proc_msg>.*)$

# regex against proc_name: situation
#[PARSER]
#    name   name_msg
#    format regex
#    regex  ^(?<proc_name>[^\[:]+): (?<proc_msg>.*)$

[PARSER]
    name   ssh_pubkey
    format regex
    regex  ^Accepted publickey for (?<user>[^ ]+) from (?<src_ip>[0-9.]+) port [0-9]+ (?<ssh_proto>[^:]+): (?<algo>[^ ]+) (?<pubkey>.*)$