From 752dabb08b38dae33c5c50b55c8fda35af8f096e Mon Sep 17 00:00:00 2001
From: Jean GOUDY <jean.goudy@sekoia.io>
Date: Wed, 14 Feb 2024 16:40:50 +0100
Subject: [PATCH] fix(auditbeat-conf): fix file input

---
 .../features/collect/integrations/endpoint/auditbeat_linux.md   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md b/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md
index e5997da4ff..1ce10456b5 100644
--- a/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md
+++ b/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md
@@ -240,7 +240,7 @@ And add a dedicated configuration file for the Auditbeat logs in `/etc/rsyslog.d
 ```bash
 module(load="imfile" PollingInterval="10")              #needs to be done just once
 input(type="imfile"
-      File="/tmp/auditbeat/auditbeat"
+      File="/tmp/auditbeat/auditbeat*.ndjson"
       Tag="linux_auditbeat"
       Severity="info"
       Facility="local7"