Not really, as I was trying to use it as a workaround to the issue I posted here. Right now, the only way I've gotten the auditd module to work is via the Pipeline used by Filebeat. I tried to force Logstash to use the same pipeline, and it didn't work
My thinking was, since Logstash wasn't working for me, I can send stuff straight to file in Logstash (via file output, or I could just send it to the syslog process on the box, which is listening).
Then, I could point Filebeat to those files and ship, defining the pipeline. It was really an attempt at a workaround of that other issue. But it would still be handy to have.