diff --git a/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md b/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md
index e5997da4ff..1ce10456b5 100644
--- a/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md
+++ b/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md
@@ -240,7 +240,7 @@ And add a dedicated configuration file for the Auditbeat logs in `/etc/rsyslog.d
 ```bash
 module(load="imfile" PollingInterval="10")              #needs to be done just once
 input(type="imfile"
-      File="/tmp/auditbeat/auditbeat"
+      File="/tmp/auditbeat/auditbeat*.ndjson"
       Tag="linux_auditbeat"
       Severity="info"
       Facility="local7"