Auditbeat memory usage gradually increases

Elastic Stack Beats
1

Hi,

I am running auditbeat-8.12.1 across a number of hosts. After restarting the service, I am seeing the memory usage grow from 0.6% to 13% over a period of 8 hours. It will continue until OOM.

I assumed this may be a queue issue, so have attempted to configure synchronous mode (which I assume wouldn't consume memory due to queueing).

queue:
  mem:
    # Max number of events the queue can buffer.
    events: 3200
    flush.min_events: 0
    flush.timeout: 0s

Is that correct? Has anyone else seen this gradual increase in memory consumption?

Thanks.