# Linux audit trail file to ECS output

**URL:** https://discuss.elastic.co/t/linux-audit-trail-file-to-ecs-output/245285
**Category:** Beats
**Tags:** auditbeat
**Created:** [August 17, 2020, 4:42pm UTC](https://discuss.elastic.co/t/linux-audit-trail-file-to-ecs-output/245285 "2020-08-17T16:42:49Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![ToddH](https://avatars.discourse-cdn.com/v4/letter/t/bb73d2/32.png) [@ToddH](https://discuss.elastic.co/u/ToddH)
#### Post date: [August 17, 2020, 4:42pm UTC](https://discuss.elastic.co/t/linux-audit-trail-file-to-ecs-output/245285/1 "2020-08-17T16:42:49Z")

</div>

I've successfully configured Auditbeat to collect logs on a Linux system (CentOS 7.7).

However, I also have some systems that (for policy reasons) cannot have Auditbeat installed on them. Periodically the audit trail files for these systems are downloaded to another machine.

Is there a way to get Auditbeat to read a Linux audit trail file and generate the Auditbeat JSON output?

Thanks,

Todd

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 14, 2020, 6:43pm UTC](https://discuss.elastic.co/t/linux-audit-trail-file-to-ecs-output/245285/2 "2020-09-14T18:43:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.