filter-sudo.conf

filter {
    if "COMMAND" in [message] {
      grok {
        match => ["message","%{SPACE}%{DATA:[user][name]}%{SPACE}:( %{DATA:[sudo][error]} ;)? TTY=%{DATA:[sudo][terminal][device]} ; PWD=%{DATA:[sudo][pwd]} ; USER=%{DATA:[sudo][user]} ; COMMAND=%{GREEDYDATA:[sudo][command]}"]
        id => "sudo"
        tag_on_failure => ["_grokparsefailure","sudo_grok_failed"]
        add_field => {
          "[sudo][eventtype]" => "sudo_command"
        }
      }
         if [sudo][error] {
           mutate {
             replace => { "[sudo][eventtype]" => "sudo_error" }
           }
         }
    }

    if [message] =~ /^pam_unix\(sudo(-i)?:session\)/ {
      grok {
        match => ["message","pam_unix\(%{DATA:[sudo][process]}?:session\): session %{WORD:[sudo][session_status]} for user %{USERNAME:[sudo][user]}(\(uid=%{NUMBER:[sudo][id]}\))?( by (%{SPACE}%{USERNAME:[user][name]}%{SPACE})?\(uid=(%{NUMBER:[user][id]})\))?"]
        id => "sudo_session_status"
        tag_on_failure => ["_grokparsefailure","sudo_session_status_grok_failed"]
        add_field => {
          "[sudo][eventtype]" => "sudo_session"
        }
      }
     }
   if [message] =~ /^pam_unix\(sudo-i:auth\)/ {
      grok {
        match => ["message","pam_unix\(sudo:auth\): %{DATA:[sudo][authentication_status]}; logname\=%{USERNAME:[sudo][user]} uid\=%{NUMBER:[uid]} euid\=%{NUMBER:[effective_uid]} tty=%{DATA:[sudo][terminal][device]} ruser\=%{USERNAME:[user][real_user]} rhost\=%{USERNAME:[host][real_host]}?  user\=%{USERNAME:[effective][user]}"]
        id => "sudo_authentication"
        tag_on_failure => ["_grokparsefailure","sudo_authentication_grok_failed"]
        add_field => {
          "[sudo][eventtype]" => "sudo_authentication"
        }
      }
     }
}