Auditbeat multiple hosts in one file

Elastic Stack Beats
3

Welcome Dean to the Elastic community,

First of all, please have a look at the best practice here in the forum:

I would like to help you very much, however without some additional information, it's difficult to track.

Would you mind please to share the audisp and auditd config files:
audisp-remote.conf
au-remote.conf
auditd.conf

as well as the auditbeat.yml please?
That would help better to understand what happens.