# Auditbeat inputs question

**URL:** <https://discuss.elastic.co/t/auditbeat-inputs-question/335328>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [June 6, 2023, 11:10am UTC](https://discuss.elastic.co/t/auditbeat-inputs-question/335328 "2023-06-06T11:10:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zaheerabbas1988](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaheerabbas1988/32/121891_2.png) [@zaheerabbas1988](https://discuss.elastic.co/u/zaheerabbas1988)\
**Post date:** [June 6, 2023, 11:10am UTC](https://discuss.elastic.co/t/auditbeat-inputs-question/335328/1 "2023-06-06T11:10:13Z")

</div>

Hello ELK community,

I have a scenario where I need to input a specific log file into Auditbeat. In Filebeat, I can achieve this easily by configuring the log file path in the `filebeat.inputs` section. However, I was wondering if a similar approach is possible in Auditbeat without having to install both Auditbeat and Filebeat on the same machine.

Is there a way to configure a specific log file input in Auditbeat, similar to how it is done in Filebeat? I want to avoid the overhead of managing two separate Beat installations on a single machine.

Any insights or recommendations would be greatly appreciated.

Thank you in advance for your help!

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [June 8, 2023, 9:33am UTC](https://discuss.elastic.co/t/auditbeat-inputs-question/335328/2 "2023-06-08T09:33:30Z")

</div>

Hi @zaheerabbas1988,

Others might know otherwise, but I don't think Auditbeat can ingest from files as it takes input from the [supported modules](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-modules.html).

Can you explain if this is an application log or other source? I'm assuming your file doesn't contain the metrics that AuditBeat intends to capture in the file.

---

<div class="post-metadata">

**Author:** ![zaheerabbas1988](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaheerabbas1988/32/121891_2.png) [@zaheerabbas1988](https://discuss.elastic.co/u/zaheerabbas1988)\
**Post date:** [June 8, 2023, 3:37pm UTC](https://discuss.elastic.co/t/auditbeat-inputs-question/335328/3 "2023-06-08T15:37:51Z")

</div>

Hi Carly, Many thanks for your time and reply.

> [@carly.richmond](#):
>
> Can you explain if this is an application log or other source? I'm assuming your file doesn't contain the metrics that AuditBeat intends to capture in the file.

You are correct. It's basically a custom script listening to incoming webhooks and storing logs related to that in a /var/foo/bar.log.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2023, 5:38pm UTC](https://discuss.elastic.co/t/auditbeat-inputs-question/335328/4 "2023-07-06T17:38:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.