adjusted query_authlog_root_login

- filter ssh signature: awx
- filter ssh signature: gitlabci

kustomize/base/files/exporter.cfg

@@ -9,31 +9,53 @@ QueryIndices = <*-authlog-*>
 QueryOnError = drop
 QueryOnMissing = drop
 QueryJson = {
-        "size": 0,
+  "size": 0,
-        "query": {
+    "query": {
-          "bool": {
+      "bool": {
-            "must": [],
+        "must": [],
-            "filter": [
+        "filter": [
-              {
+          {
-                "range": {
+            "range": {
-                  "@timestamp": {
+              "@timestamp": {
-                    "format": "strict_date_optional_time",
+                "format": "strict_date_optional_time",
-                    "gte": "now-5m/m",
+                "gte": "now-5m/m",
-                    "lte": "now"
+                "lte": "now"
-                  }
-                }
-              },
-              {
-                "exists": {
-                  "field": "system.auth.user"
-                }
-              },
-              {
-                "match_phrase": {
-                  "system.auth.user": "root"
-                }
               }
-            ]
+            }
+          },
+          {
+            "exists": {
+              "field": "system.auth.user"
+            }
+          },
+          {
+            "match_phrase": {
+              "system.auth.user": "root"
+            }
+          },
+          {
+            "match_phrase": {
+              "system.auth.ssh.event": "Accepted"
+            }
           }
-        }
+        ],
+        "must_not": [
+          {
+            "exists": {
+              "field": "system.auth.sudo.user"
+            }
+          },
+          {
+            "match_phrase": {
+              "system.auth.ssh.signature": "ED25519 SHA256:mbqaHromGo9o0xRQW7yQG5X4Y72t9k2eJdvsOAOYNvc"
+            }
+          },
+          {
+            "match_phrase": {
+              "system.auth.ssh.signature": "ED25519 SHA256:FdAFdv9hoxEWiViXl9k8WRwq5OoWDvGQL+uzg6vjV3Q"
+            }
+          }
+        ]
+      }
     }
+  }