{
  "paths": [
    "/var/log/syslog",
    "/var/log/auth.log"
   ],
  "fields": { "type": "syslog" }
}