Update to 2021-12-01 19:13

roles/filebeat/templates/ansible_modules.d/auditd.yml.j2

@@ -0,0 +1,7 @@
+- module: auditd
+  log:
+    enabled: True
+    input:
+      exclude_files:
+        - '\.[xg]z$'
+        - '\d+$'

roles/filebeat/templates/ansible_modules.d/system.yml.j2

@@ -0,0 +1,9 @@
+{% if ansible_service_mgr == 'systemd' %}
+# We use journalbeat on systemd based systems
+{% else %}
+- module: system
+  syslog:
+    enabled: True
+  auth:
+    enabled: True
+{% endif %}