module_version: 1.0

var:
  - name: paths
    default:
      - /var/log/auth.log*
      - /var/log/secure*
    os.darwin:
      # this works in OS X < 10.8. Newer darwin versions don't write
      # ssh logs to files
      - /var/log/secure.log*
    os.windows: []
  - name: convert_timezone
    default: false
    # if ES < 6.1.0, this flag switches to false automatically when evaluating the
    # pipeline
    min_elasticsearch_version:
      version: 6.1.0
      value: false

ingest_pipeline: ingest/pipeline.json
input: config/auth.yml
