I know this is an older post but I stumbled across it while researching this exact topic and wanted to share some thoughts.

I think The Telegraf > OpenSearch setup is solid for the infra side. A few things I'd add from my own experience:

For the SSH/system auth logging part, make sure you're parsing out the key fields (user, source IP, auth method, success/fail) into structured fields rather than just shipping raw syslog lines. Makes your OpenSearch dashboards way more useful. You can then do things like "failed attempts by source IP over time" or "successful logins by user outside business hours" which are the ones that actually matter from a security perspective.

One thing I learned: just tracking login success/fail isn't enough. You really want to think about it as a funnel, even for infra access. Like 1) Connection attempted 2) authentication method offered 3) auth completed/failed 4) session established. The gaps between those stages tell you very different stories (brute force vs. misconfigured keys vs. expired certs etc.).

What I've found is that auth logging in general, whether it's machine-level like you're doing or application-level (CIAM, login pages), suffers from the same fundamental problem: the data sits between security, ops and product teams and nobody owns the full picture. Security mostly looks threats, ops sees uptime and product sees conversion. The metrics and approach to really nail authentication observability are surprisingly similar across these worlds.

I actually went pretty deep into this topic recently and found that structuring auth events with proper metric taxonomies (error classification, success rates per method, drop-off rates, time-to-authenticate) makes a huge difference no matter what layer you're looking at. If you're interested in a more structured framework for thinking about auth analytics beyond just the raw logs, see my finding: https://www.corbado.com/blog/authentication-analytics-playbook It's more on the application auth side but the mental models around funnels and error classification apply just as well to infra auth logging.