--- /var/log/auth.log: - first: date second: user pattern: '^(.{15}).*Accepted publickey for (\S+) .*' - first: date second: user pattern: '^(.{15}).*Successful login as (\S+) .*' /var/log/mail.log: - first: date second: user pattern: '^(.{15}).*Login: user=<([^>]+).*'