module_version: 1.0
var:
- name: paths
default:
- /var/log/auth.log*
- /var/log/secure*
os.darwin:
# this works in OS X < 10.8. Newer darwin versions don't write
# ssh logs to files
- /var/log/secure.log*
os.windows: []
- name: tags
default: []
ingest_pipeline: ingest/pipeline.yml
input: config/auth.yml