From 350e2081f227a50e0e3a1526d594b5e05d2a8e4f Mon Sep 17 00:00:00 2001
From: sabban <github@sabban.eu>
Date: Wed, 28 Jun 2023 10:23:40 +0200
Subject: [PATCH] add journalctl for ssh by default

---
 config/acquis.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/config/acquis.yaml b/config/acquis.yaml
index cc3631f3e..69976b382 100644
--- a/config/acquis.yaml
+++ b/config/acquis.yaml
@@ -10,6 +10,12 @@ filenames:
  - /var/log/syslog
 labels:
   type: syslog
+--- 
+source: journalctl
+journalctl_filter:
+ - "_SYSTEMD_UNIT=ssh.service"
+labels:
+  type: syslog
 ---
 filename: /var/log/apache2/*.log
 labels: