Modified shipper.conf to identify syslog events indicated failed SSH logins. Added grok-patterns file in case the 'grokparsefailure' messages related to the patterns being unknown.