From: Manuel Sabban <github@sabban.eu>
Date: Wed Jun 28 10:23:40 2023 +0200
Subject: Add journalctl for ssh by default
Origin: https://github.com/crowdsecurity/crowdsec/pull/2316/
diff --git a/config/acquis.yaml b/config/acquis.yaml
index cc3631f3..69976b38 100644
--- a/config/acquis.yaml
+++ b/config/acquis.yaml
@@ -10,6 +10,12 @@ filenames:
  - /var/log/syslog
 labels:
   type: syslog
+---
+source: journalctl
+journalctl_filter:
+ - "_SYSTEMD_UNIT=ssh.service"
+labels:
+  type: syslog
 ---
 filename: /var/log/apache2/*.log
 labels: