#------------------------------ Secure Log -------------------------------
- type: log
  enabled: true
  paths:
  - /var/log/secure
  include_lines: [": Invalid user ", ": Accepted password ", ": Accepted publickey ", ": authentication failure;"]
  tail_files: false
  pipeline: secure-login