diff --git a/rsyslog/meta/heka.yml b/rsyslog/meta/heka.yml
index 2e8a567..3c31c40 100644
--- a/rsyslog/meta/heka.yml
+++ b/rsyslog/meta/heka.yml
@@ -33,3 +33,13 @@
       differentiator: [ 'system.', 'haproxy' ]
       decoder: "syslog_decoder"
       splitter: "TokenSplitter"
+  filter:
+    failed_logins:
+      engine: sandbox
+      module_file: /usr/share/lma_collector/filters/failed_logins.lua
+      module_dir: /usr/share/lma_collector/common;/usr/share/heka/lua_modules
+      message_matcher: "Type == 'log' && Logger == 'system.auth'"
+      ticker_interval: 60
+      config:
+        hostname: '{{ grains.host }}'
+        grace_interval: 30