elk systemlog disk error add

LOG/SYSTEM/README.md

@@ -147,6 +147,16 @@ filter {
       match => { "message" => "%{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: Accepted password for %{USERNAME:sshd_invalid_user} from %{IPORHOST:sshd_client_ip} port %{NUMBER:sshd_port} %{GREEDYDATA:sshd_protocol}" }
     }
 
+    grok {
+      match => ["message", "Error updating SMART data: Error sending ATA command CHECK"]
+      add_tag => "HDD_SMART_CHECK_ERROR"
+    }
+
+    grok {
+      match => ["message", "Buffer I/O error"]
+      add_tag => "DISK_ERROR"
+    }
+
     mutate {
       convert => {"geoip.city_name" => "string"}
     }