From 057d36329739fc80ac2b6e668d0e4dcdf0be3140 Mon Sep 17 00:00:00 2001
From: Jean GOUDY <jean.goudy@sekoia.io>
Date: Thu, 29 Feb 2024 16:45:12 +0100
Subject: [PATCH] fix(doc-auditbeat): fix regex

---
 .../features/collect/integrations/endpoint/auditbeat_linux.md   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md b/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md
index 1ce10456b5..c1f361d4d0 100644
--- a/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md
+++ b/docs/xdr/features/collect/integrations/endpoint/auditbeat_linux.md
@@ -249,7 +249,7 @@ input(type="imfile"
       )
 
 ruleset(name="auditbeatSekoia") {
-    if (re_match($!metadata!filename, "auditbeat-[0-9]{8}.ndjson")) then {  
+    if (re_match($!metadata!filename, "auditbeat-[0-9]{8}(-[0-9]*)?.ndjson")) then {
       action(
         type="omfwd"
         protocol="tcp"