Configure filter emitting metrics on failed logins
Change-Id: I0b30ca988cad5d30fa63cdbb63bb1aa242e2df10
Depends-On: I1a20a356920edf189bbc7430c57f9084b5d6a6b7
diff --git a/rsyslog/meta/heka.yml b/rsyslog/meta/heka.yml
index 2e8a567..3c31c40 100644
--- a/rsyslog/meta/heka.yml
+++ b/rsyslog/meta/heka.yml
@@ -33,3 +33,13 @@
differentiator: [ 'system.', 'haproxy' ]
decoder: "syslog_decoder"
splitter: "TokenSplitter"
+ filter:
+ failed_logins:
+ engine: sandbox
+ module_file: /usr/share/lma_collector/filters/failed_logins.lua
+ module_dir: /usr/share/lma_collector/common;/usr/share/heka/lua_modules
+ message_matcher: "Type == 'log' && Logger == 'system.auth'"
+ ticker_interval: 60
+ config:
+ hostname: '{{ grains.host }}'
+ grace_interval: 30