auditbeat.yml

name: Auditbeat
cmd: auditbeat
args: [
  "-c", "auditbeat.elastic-agent.yml",
  "-E", "setup.ilm.enabled=false",
  "-E", "setup.template.enabled=false",
  "-E", "management.enabled=true",
  "-E", "logging.level=debug",
  "-E", "gc_percent=${AUDITBEAT_GOGC:100}",
  "-E", "auditbeat.config.modules.enabled=false"
]
artifact: beats/auditbeat
restart_on_output_change: true

rules:
- fix_stream: {}

# All Auditbeat input types begin with 'audit/'.
- filter_values_with_regexp:
    key: type
    re: '^audit/.+'
    selector: inputs

# Adds 'index: logs-{data_stream.dataset}-{data_stream.namespace}' to each input.
- inject_index:
    type: logs

# Adds two add_fields processors - one for event.dataset and one for
# data_stream.dataset, data_stream.type, and data_stream.namespace.
- inject_stream_processor:
    on_conflict: insert_after
    type: logs

# Convert input[].streams[] into inputs[].
- extract_list_items:
    path: inputs
    item: streams
    to: inputs

- map:
    path: inputs
    rules:
    # Input types for Auditbeat begin with 'audit/'. Everything after that is
    # treated as the module name.
    - translate_with_regexp:
        path: type
        re: '^audit/(.+)'
        with: $1
    - rename:
        from: type
        to: module
    # If a dataset is specified convert that into 'datasets: [$item]'.
    - make_array:
        item: dataset
        to: datasets
    - remove_key:
        key: dataset
    - remove_key:
        key: enabled
    - remove_key:
        key: data_stream
    - remove_key:
        key: condition
    # Require all config to come through the Agent (no local files).
    - remove_key:
        key: audit_rule_files

- filter_values:
    selector: inputs
    key: module
    values:
      - auditd
      - file_integrity
      - system

# Adds two add_fields processors - one for agent.id and one for
# elastic_agent.id, elastic_agent.snapshot, elastic_agent.version.
- inject_agent_info: {}

- copy:
    from: inputs
    to: auditbeat

- rename:
    from: auditbeat.inputs
    to: modules

- filter:
    selectors:
    - auditbeat
    - output
    - keystore

# Inject headers into the output configuration.
- inject_headers: {}

when: length(${auditbeat.modules}) > 0 and hasKey(${output}, 'elasticsearch',
  'redis', 'kafka', 'logstash')