Auditbeat not updating usernames and process data in file_integrity module

I have installed Auditbeat which is working fine. However, when I try to query data related to user creating, deleting files which uses the file_integrity module, it shows records/documents without the user.names in it. Even the process.args is blank. This does not provide information on who did and how was it done.

How do I setup to populate the fields for this data.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.