Hi,
I have installed Auditbeat which is working fine. However, when I try to query data related to user creating, deleting files which uses the file_integrity module, it shows records/documents without the user.names in it. Even the process.args is blank. This does not provide information on who did and how was it done.
How do I setup to populate the fields for this data.