data.json

{
    "@timestamp": "2017-10-12T08:05:34.853Z",
    "agent": {
        "hostname": "host.example.com",
        "name": "host.example.com"
    },
    "auditd": {
        "data": {
            "acct": "(invalid user)",
            "op": "login",
            "terminal": "sshd"
        },
        "message_type": "user_login",
        "result": "fail",
        "sequence": 19955,
        "session": "unset",
        "summary": {
            "actor": {
                "primary": "unset",
                "secondary": "(invalid user)"
            },
            "how": "/usr/sbin/sshd",
            "object": {
                "primary": "sshd",
                "secondary": "179.38.151.221",
                "type": "user-session"
            }
        }
    },
    "event": {
        "action": "logged-in",
        "category": "user-login",
        "module": "auditd",
        "original": [
            "type=USER_LOGIN msg=audit(1492896301.818:19955): pid=12635 uid=0 auid=4294967295 ses=4294967295 msg='op=login acct=28696E76616C6964207573657229 exe=\"/usr/sbin/sshd\" hostname=? addr=179.38.151.221 terminal=sshd res=failed'"
        ]
    },
    "network": {
        "direction": "inbound"
    },
    "process": {
        "executable": "/usr/sbin/sshd",
        "pid": 12635
    },
    "service": {
        "type": "auditd"
    },
    "source": {
        "ip": "179.38.151.221"
    },
    "user": {
        "audit": {
            "id": "unset"
        },
        "id": "0",
        "name": "root"
    }
}