---
title: 'Beats: Auditbeat'
description: Send Auditbeat audit data to Coralogix through your own Logstash instance, from a host machine or a Docker container.
url: https://coralogix.com/docs/integrations/security/beats-auditbeat/
product: snowbit
feature: Snowbit Overview
feature_id: snowbit-general
feature_identifier: snowbit/snowbit-general
last_updated: '2026-10-29'
---

# Beats: Auditbeat

Coralogix provides seamless integration with `Auditbeat` so you can send your audit data from anywhere into Coralogix.

## [](https://github.com/coralogix/integrations-docs/blob/master/integrations/auditbeat/README.rst#prerequisites)Prerequisites

* [Install](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-installation.html) `Auditbeat`.

* A [Logstash](https://coralogix.com/docs/integrations/files/logstash.md) instance that you run in your own infrastructure, configured to receive Beats input and forward it to Coralogix. Coralogix no longer hosts a Logstash server for Beats shippers. See [Run your own Logstash instance](https://coralogix.com/docs/user-guides/latest-updates/deprecations/logstash.md#run-your-own-logstash-instance) for the Logstash input, filter, and output configuration.

## [](https://github.com/coralogix/integrations-docs/blob/master/integrations/auditbeat/README.rst#general)General

**Private Key** – Your [Send Your Data - API Key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md) is a unique ID that represents your company.

**Company Id** – A unique number which represents your company. You can get your company id from the settings tab in the *Coralogix* dashboard.

**Application Name** – The name of your main application, for example, a company named *"SuperData"* would probably insert the *"SuperData"* string parameter or if they want to debug their test environment they might insert the *"SuperData– Test"*.

**SubSystem Name** – Your application probably has multiple subsystems, for example: Backend servers, Middleware, Frontend servers etc. in order to help you examine the data you need, inserting the subsystem parameter is vital.

## [](https://github.com/coralogix/integrations-docs/blob/master/integrations/auditbeat/README.rst#configuration)Configuration

### [](https://github.com/coralogix/integrations-docs/blob/master/integrations/auditbeat/README.rst#on-host-machine)At the Host machine

Open your `Auditbeat` configuration file and configure it to use `Logstash`. For more information about configuring `Auditbeat` to use `Logstash` please refer to: <https://www.elastic.co/guide/en/beats/auditbeat/current/logstash-output.html>

Point your `Auditbeat` to output to your own Logstash instance:

```
<logstash-ip-address>:5044
```

Note

The Coralogix-hosted Logstash endpoints (`logstashserver.coralogix.com`, `logstash.coralogix.in`, `logstashserver.coralogix.us`) are retired and no longer accept data. See [Deprecation of Coralogix-hosted Logstash](https://coralogix.com/docs/user-guides/latest-updates/deprecations/logstash.md).

Set the **General** values (Send-Your-Data API key, application name, and subsystem name) in your Logstash configuration, not in `auditbeat.yml`.

Here is a basic example of an **auditbeat.yml** file for watching some folders on your server:

```
#============================= Auditbeat Modules ===============================



auditbeat.modules:

- module: file_integrity

  enabled: true

  paths:

  - /bin

  - /usr/bin

  - /sbin

  - /usr/sbin

  - /etc



#----------------------------- Logstash output --------------------------------



output.logstash:

  enabled: true

  hosts: ["<logstash-ip-address>:5044"]
```

### [](https://github.com/coralogix/integrations-docs/blob/master/integrations/auditbeat/README.rst#with-docker)Using Docker

Build a Docker image with your **auditbeat.yml**:

```
FROM docker.elastic.co/beats/auditbeat:6.6.2



LABEL description="Auditbeat filesystem audit data collector"



# Adding configuration file for Auditbeat

COPY auditbeat.yml /usr/share/auditbeat/auditbeat.yml



# Changing permission of configuration file

USER root

RUN chown root:auditbeat /usr/share/auditbeat/auditbeat.yml



# Return to deploy user

USER auditbeat
```

## [](https://github.com/coralogix/integrations-docs/blob/master/integrations/auditbeat/README.rst#usage)Usage

You can deploy with *Docker-compose*:

```
version: '3.6'

services:

  auditbeat:

    image: docker.elastic.co/beats/auditbeat:6.6.2

    container_name: auditbeat

    volumes:

      - ./auditbeat.yml:/usr/share/auditbeat/auditbeat.yml:ro
```

Important: Don't forget to change the owner of **auditbeat.yml** file to *root* (uid=1000).