Zenoss designed it that way, each "instance" or in your case 'ssh login' creates an unique event. Why do you want to merge those events Events get archived and then eventually dropped, so after "x" days the event will be deleted.

The only real way you could do it, is to drop the new event and modify an existing event, but I wouldn't recommend it.

Hydruid

I want merge instances with same login and remotehost. Remote port doesn't matter for me.

For example, there are 2 new incoming events:
1 - "Accepted password for root from 192.168.1.23 port 57701 ssh2"
2 - "Accepted password for root from 192.168.1.23 port 58901 ssh2"

After class mapping and transforming summary field is "Accepted password for root from 192.168.1.23"
And dedupid fields are same for those events. But zenoss creates 2 different instances with same dedupid field.

I solved my problem. Solution was quite simple: when I created class mapping, I changed event status to "history". In this case all incoming events save as unique although the events has same dedupid field.