# Auditbeat identifying directories as files **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [December 21, 2018, 11:26am UTC](https://discuss.elastic.co/t/auditbeat-identifying-directories-as-files/161834 "2018-12-21T11:26:18Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![nlh](https://avatars.discourse-cdn.com/v4/letter/n/f9ae1b/32.png) [@nlh](https://discuss.elastic.co/u/nlh)\ **Post date:** [December 21, 2018, 11:26am UTC](https://discuss.elastic.co/t/auditbeat-identifying-directories-as-files/161834/1 "2018-12-21T11:26:18Z")
Hi, Running Auditbeat 6.4.2 and monitoring a directory. I can see when someone is navigating through a directory tree so for file.path I get /PTC/mq/code /PTC/mq/code/4Q2018 /PTC/mq/code/4Q2018/scan /PTC/mq/code/4Q2018/scan/src /PTC/mq/code/4Q2018/scan/src/api-server-master /PTC/mq/code/4Q2018/scan/src/api-server-master/Dockerfile Apart from this last one, all the previous ones are directories. This last one was a file I copied. auditd.summary.object.type has them all set to path and even the event.action is set to open-file. I'm guessing this might be a limitation, but it would be unbelievably useful to me to filter out directories at the Logstash/Elasticsearch end. Can this be done? Please let me know if you need any more info. Thanks, N ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 11, 2019, 11:26am UTC](https://discuss.elastic.co/t/auditbeat-identifying-directories-as-files/161834/2 "2019-01-11T11:26:20Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.