Configure Auditbeat
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
To get started quickly, read Quick start: installation and configuration.
To configure Auditbeat, edit the configuration file. The default configuration file is called auditbeat.yml. The location of the file varies by platform. To locate the file, see Directory layout.
There’s also a full example configuration file called auditbeat.reference.yml that shows all non-deprecated options.
See the Config File Format for more about the structure of the config file.
The following topics describe how to configure Auditbeat:
- Modules
- General settings
- Project paths
- Config file reloading
- Output
- SSL
- Index lifecycle management (ILM)
- Elasticsearch index template
- Kibana endpoint
- Kibana dashboards
- Processors
- Internal queue
- Logging
- HTTP endpoint
- Regular expression support
- Instrumentation
- Feature flags
- auditbeat.reference.yml
After changing configuration settings, you need to restart Auditbeat to pick up the changes.