Thanks for the response. Filebeat is indeed working on that CentOS 5 machine.
To be honest, the only thing I use auditbeat for is one of its default "Login events" dashboards.
Is there a way I could ship the same information with filebeat so it would end in this exact dashboard?