/etc/auditbeat/audit.rules.d/sample-rules.conf.disabled /etc/auditbeat/auditbeat.reference.yml /etc/auditbeat/auditbeat.yml /etc/auditbeat/fields.yml